asyncrat

General

Target
ffd4eb84d30487daae13452db290c8a31332a93e818fa88cdc2f8041fd035c57.exe
Size 17KB
Sample221109-psby6aadhj
SHA256 ffd4eb84d30487daae13452db290c8a31332a93e818fa88cdc2f8041fd035c57
MD5 19c10a7d818b70b9947e6851849fd2df
SHA1 0761493f617982c330fafa68ed8bbb5c312a2d82
SHA512 b408f4c020981139fe610cfcc79b12bec1295c18c16a4fe810f0925d34fc1b844a4a9e7716b6b0abbb0fd5a7b2303c81dc64435fc88e0f4edb163de2c6285382
SSDEEP 192:xNIUPBsnnBZHJUmJoeYG8R+ZscF8Bd1LQJEul4uhUmJoeYG8R+ZscF8Bd1L/Jzg2:xxpIhJoSXZsHLQJEruhoSXZsHL/Jmhq
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

Malware Config

Extracted

Family

asyncrat

Botnet

Default

C2

127.0.0.1:6606
127.0.0.1:7707
127.0.0.1:8808
https://api.telegram.org/bot5733301341:AAF6S_qPXNWS0WW5VbV6kBv7HBzZIREbZ_g/sendMessage?chat_id=1071532135

Mutex

AsyncMutex_6SI8OkPnk

Attributes

delay
3
install
false
install_folder
%AppData%

aes.plain

Targets

- Target
  ffd4eb84d30487daae13452db290c8a31332a93e818fa88cdc2f8041fd035c57.exe
- Size 17KB
- SHA256 ffd4eb84d30487daae13452db290c8a31332a93e818fa88cdc2f8041fd035c57
- MD5 19c10a7d818b70b9947e6851849fd2df
- SHA1 0761493f617982c330fafa68ed8bbb5c312a2d82
- SHA512 b408f4c020981139fe610cfcc79b12bec1295c18c16a4fe810f0925d34fc1b844a4a9e7716b6b0abbb0fd5a7b2303c81dc64435fc88e0f4edb163de2c6285382
- SSDEEP 192:xNIUPBsnnBZHJUmJoeYG8R+ZscF8Bd1LQJEul4uhUmJoeYG8R+ZscF8Bd1L/Jzg2:xxpIhJoSXZsHLQJEruhoSXZsHL/Jmhq
- MD5 SHA1 SHA512 SSDEEP
Score

10^/10

asyncrat stormkitty default evasion persistence rat spyware stealer vmprotect collection
- AsyncRat
  AsyncRAT is designed to remotely monitor and control other computers.
  rat asyncrat
- StormKitty
  StormKitty is an open source info stealer written in C#.
  stealer stormkitty
- StormKitty payload
- Async RAT payload
  rat
- Downloads MZ/PE file
- Executes dropped EXE
- Modifies Windows Firewall
  evasion
- VMProtect packed file
  Detects executables packed with VMProtect commercial packer.
  vmprotect
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Drops startup file
- Loads dropped DLL
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Accesses Microsoft Outlook profiles
  collection
- Adds Run key to start application
  persistence
- Drops desktop.ini file(s)
- Legitimate hosting services abused for malware hosting/C2
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
- Looks up geolocation information via web service
  Uses a legitimate geolocation service to find the infected system's geolocation info.
- Drops file in System32 directory
behavioral1 behavioral2