asyncrat

General

Target

Private_Key_17GbKcfZiM6EFW86fhgTAoN7TfBcdmW4d6.scr.exe
Size

1.7MB
Sample

230111-mwnq1sbh29
MD5

0af5c337082f7f3d9249ca5cdfd2d4ce
SHA1

aeb90df77e8fc06b9a42287cb277710e5305c9bc
SHA256

069da9838ffd1b21d13c0a1952608e29e64e7b40847ab3fb67e16cfd797ab834
SHA512

12e07a9e86bbad4b34b0a603f62396fae24746a7d349a7506a83d625da08fd0dd8fc6dea2d6828f62ccc8e13a3f885831cd65f0b4ed3e97368298f809270ee73
SSDEEP

49152:eafU0nviMsLVdf2Hc5HxK0Es0WLw2ifBJ6Qu:VfHKzLzf2QAJrfc

Score

10^/10

Malware Config

Extracted

Family

darkcomet

Botnet

New-July-July4-01

C2

dgorijan20785.hopto.org:35800

Mutex

DC_MUTEX-N3AV3EU

Attributes

gencode
sGSTFQ1pY1TB
install
false
offline_keylogger
true
password
hhhhhh
persistence
false

Extracted

Family

warzonerat

C2

dgorijan20785.hopto.org:5199

45.74.4.244:5199

Extracted

Family

darkcomet

Botnet

New-July-July4-0

C2

45.74.4.244:35800

Mutex

DC_MUTEX-RT27KF0

Attributes

gencode
cKUHbX2GsGhs
install
false
offline_keylogger
true
password
hhhhhh
persistence
false

Extracted

Family

asyncrat

Version

0.5.6A

C2

45.74.4.244:6606

45.74.4.244:7707

45.74.4.244:8808

Mutex

servtle284

Attributes

delay
5
install
true
install_file
wintskl.exe
install_folder
%AppData%

aes.plain

Targets

- Target
  
  Private_Key_17GbKcfZiM6EFW86fhgTAoN7TfBcdmW4d6.scr.exe
- Size
  
  1.7MB
- MD5
  
  0af5c337082f7f3d9249ca5cdfd2d4ce
- SHA1
  
  aeb90df77e8fc06b9a42287cb277710e5305c9bc
- SHA256
  
  069da9838ffd1b21d13c0a1952608e29e64e7b40847ab3fb67e16cfd797ab834
- SHA512
  
  12e07a9e86bbad4b34b0a603f62396fae24746a7d349a7506a83d625da08fd0dd8fc6dea2d6828f62ccc8e13a3f885831cd65f0b4ed3e97368298f809270ee73
- SSDEEP
  
  49152:eafU0nviMsLVdf2Hc5HxK0Es0WLw2ifBJ6Qu:VfHKzLzf2QAJrfc
Score

10^/10

asyncrat darkcomet warzonerat new-july-july4-0 new-july-july4-01 infostealer persistence rat trojan upx
- AsyncRat
  AsyncRAT is designed to remotely monitor and control other computers.
  rat asyncrat
- Darkcomet
  DarkComet is a remote access trojan (RAT) developed by Jean-Pierre Lesueur.
  trojan rat darkcomet
- WarzoneRat, AveMaria
  WarzoneRat is a native RAT developed in C++ with multiple plugins sold as a MaaS.
  rat infostealer warzonerat
- Async RAT payload
  rat
- Warzone RAT payload
  rat
- Drops file in Drivers directory
- Executes dropped EXE
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Drops startup file
- Loads dropped DLL
- Adds Run key to start application
  persistence
- Suspicious use of SetThreadContext
behavioral1 behavioral2