asyncrat

General

Target

SOA.exe
Size

1.1MB
Sample

230106-aztefsdg69
MD5

f890903c9b2fa054a4b22b4240870db2
SHA1

06ed4e7131287fcf01e49834180567daf9a13240
SHA256

a0c77b9f372d94ae8cbc32b27d319491cb65001b12963bc68b96b8caaf10dfa0
SHA512

b230749492b8d3ceb0824badc423c163c706df0c464849950523f2bedefa2ed7f50de83ee403611f1c5559f154f0fed7335310d23233701625de65bc09b9e883
SSDEEP

12288:xJEPCBEYJmzdicP0bYzJfKMVvS1yIuDBXolPu3fgzHIGEoTCqEUbeSh39W+ll8nO:rCJRVXbe8REgRJrn85cMNd

Score

10^/10

Malware Config

Extracted

Family

asyncrat

Version

0.5.7B

Botnet

Default

C2

ESCANOR2022.LINKPC.NET:6606

ESCANOR2022.LINKPC.NET:7707

ESCANOR2022.LINKPC.NET:8808

Mutex

AsyncMutex_6SI8OkPnk

Attributes

delay
3
install
true
install_file
sqli.exe
install_folder
%AppData%

aes.plain

Targets

- Target
  
  SOA.exe
- Size
  
  1.1MB
- MD5
  
  f890903c9b2fa054a4b22b4240870db2
- SHA1
  
  06ed4e7131287fcf01e49834180567daf9a13240
- SHA256
  
  a0c77b9f372d94ae8cbc32b27d319491cb65001b12963bc68b96b8caaf10dfa0
- SHA512
  
  b230749492b8d3ceb0824badc423c163c706df0c464849950523f2bedefa2ed7f50de83ee403611f1c5559f154f0fed7335310d23233701625de65bc09b9e883
- SSDEEP
  
  12288:xJEPCBEYJmzdicP0bYzJfKMVvS1yIuDBXolPu3fgzHIGEoTCqEUbeSh39W+ll8nO:rCJRVXbe8REgRJrn85cMNd
Score

10^/10

asyncrat smokeloader default backdoor collection evasion persistence rat spyware stealer trojan
- AsyncRat
  AsyncRAT is designed to remotely monitor and control other computers.
  rat asyncrat
- Detects Smokeloader packer
- SmokeLoader
  Modular backdoor trojan in use since 2014.
  trojan backdoor smokeloader
- UAC bypass
  evasion trojan
- Async RAT payload
  rat
- Blocklisted process makes network request
- Downloads MZ/PE file
- Drops file in Drivers directory
- Executes dropped EXE
- Sets service image path in registry
  persistence
- Loads dropped DLL
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Uses the VBS compiler for execution
- Accesses Microsoft Outlook profiles
  collection
- Checks whether UAC is enabled
  evasion trojan
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
- Suspicious use of SetThreadContext
behavioral1