asyncrat

General

Target

fe5bef849559a2f89c3f9e5aa7c1ce81530e7670cbefd11bdfa3e829a3c35777
Size

537KB
Sample

221111-gtv5esbfdj
MD5

5f122d182bf00400247fdfc6a6ae9e80
SHA1

a784f94133749d462cd90298af4fdd7a7d7a320e
SHA256

fe5bef849559a2f89c3f9e5aa7c1ce81530e7670cbefd11bdfa3e829a3c35777
SHA512

3bab4dd0f6a98a6a638e5558272b4d6614b7aac5fddd3b979e624cff3af6df919bbd847ae8fa0ffa093bb6360820dcaa6a54fe7e3cfb873a8517f6d0532239cc
SSDEEP

12288:L4lThwQGIQilGzWTifG1g6eUBPwvJPOdimGzgdBY/Ug:ElTOFq7TifGG6avJoihzcKc

Score

10^/10

Malware Config

Extracted

Family

asyncrat

Version

0.5.7B

Botnet

System Guard Runtime

C2

85.105.88.221:2531

Mutex

System Guard Runtime

Attributes

delay
3
install
false
install_file
System Guard Runtime
install_folder
%AppData%

aes.plain

Extracted

Family

asyncrat

Version

0.5.7B

Botnet

DefenderSmartScren

C2

217.64.31.3:8437

Mutex

DefenderSmartScren

Attributes

delay
3
install
false
install_file
SecurityHealtheurvice.exe
install_folder
%AppData%

aes.plain

Extracted

Family

asyncrat

Version

1.0.7

Botnet

WindowsDefenderSmarttScreen

C2

217.64.31.3:9742

Mutex

WindowsDefenderSmarttScreen

Attributes

delay
1
install
false
install_file
WindowsDefenderSmarttScreen.exe
install_folder
%AppData%

aes.plain

Targets

- Target
  
  fe5bef849559a2f89c3f9e5aa7c1ce81530e7670cbefd11bdfa3e829a3c35777
- Size
  
  537KB
- MD5
  
  5f122d182bf00400247fdfc6a6ae9e80
- SHA1
  
  a784f94133749d462cd90298af4fdd7a7d7a320e
- SHA256
  
  fe5bef849559a2f89c3f9e5aa7c1ce81530e7670cbefd11bdfa3e829a3c35777
- SHA512
  
  3bab4dd0f6a98a6a638e5558272b4d6614b7aac5fddd3b979e624cff3af6df919bbd847ae8fa0ffa093bb6360820dcaa6a54fe7e3cfb873a8517f6d0532239cc
- SSDEEP
  
  12288:L4lThwQGIQilGzWTifG1g6eUBPwvJPOdimGzgdBY/Ug:ElTOFq7TifGG6avJoihzcKc
Score

10^/10

asyncrat defendersmartscren system guard runtime windowsdefendersmarttscreen persistence rat upx
- AsyncRat
  AsyncRAT is designed to remotely monitor and control other computers.
  rat asyncrat
- Async RAT payload
  rat
- Blocklisted process makes network request
- Downloads MZ/PE file
- Executes dropped EXE
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
- Adds Run key to start application
  persistence
- Suspicious use of SetThreadContext
behavioral1