asyncrat

General

Target

b77017cc9d6f22acc41306ce5b46076ad54520ac4de7e7a224476861024f7e7e
Size

2.9MB
Sample

230111-nctzcsfg6w
MD5

62a0ea786f2524412ffd7c6ea4ce87a1
SHA1

7339871230a69684d9bf81b7e2f508b49abae5bc
SHA256

b77017cc9d6f22acc41306ce5b46076ad54520ac4de7e7a224476861024f7e7e
SHA512

a0e8f9445e35c3740dea160637ecc2169366d7d54e7f536238df61155a37bcd85eb6b242122dbe16ad3b40321a532d70d516e05a95e7a474c547ef37e4c77920
SSDEEP

49152:6QDgok30CdLE6uLu0n9yIPTRDLu0no6gCWELu0nbQCQwwULu0nXM+kYLu0n:6QU/hL4LP1TRDLPo6oELPb/wULPXFLP

Score

10^/10

Malware Config

Extracted

Family

darkcomet

Botnet

New-July-July4-01

C2

dgorijan20785.hopto.org:35800

Mutex

DC_MUTEX-N3AV3EU

Attributes

gencode
sGSTFQ1pY1TB
install
false
offline_keylogger
true
password
hhhhhh
persistence
false

Extracted

Family

asyncrat

Version

0.5.6A

C2

45.74.4.244:6606

45.74.4.244:7707

45.74.4.244:8808

Mutex

servtle284

Attributes

delay
5
install
true
install_file
wintskl.exe
install_folder
%AppData%

aes.plain

Extracted

Family

warzonerat

C2

45.74.4.244:5199

dgorijan20785.hopto.org:5199

Extracted

Family

darkcomet

Botnet

New-July-July4-0

C2

45.74.4.244:35800

Mutex

DC_MUTEX-RT27KF0

Attributes

gencode
cKUHbX2GsGhs
install
false
offline_keylogger
true
password
hhhhhh
persistence
false

Targets

- Target
  
  b77017cc9d6f22acc41306ce5b46076ad54520ac4de7e7a224476861024f7e7e
- Size
  
  2.9MB
- MD5
  
  62a0ea786f2524412ffd7c6ea4ce87a1
- SHA1
  
  7339871230a69684d9bf81b7e2f508b49abae5bc
- SHA256
  
  b77017cc9d6f22acc41306ce5b46076ad54520ac4de7e7a224476861024f7e7e
- SHA512
  
  a0e8f9445e35c3740dea160637ecc2169366d7d54e7f536238df61155a37bcd85eb6b242122dbe16ad3b40321a532d70d516e05a95e7a474c547ef37e4c77920
- SSDEEP
  
  49152:6QDgok30CdLE6uLu0n9yIPTRDLu0no6gCWELu0nbQCQwwULu0nXM+kYLu0n:6QU/hL4LP1TRDLPo6oELPb/wULPXFLP
Score

10^/10

asyncrat darkcomet warzonerat new-july-july4-0 infostealer persistence rat trojan upx
- AsyncRat
  AsyncRAT is designed to remotely monitor and control other computers.
  rat asyncrat
- Darkcomet
  DarkComet is a remote access trojan (RAT) developed by Jean-Pierre Lesueur.
  trojan rat darkcomet
- WarzoneRat, AveMaria
  WarzoneRat is a native RAT developed in C++ with multiple plugins sold as a MaaS.
  rat infostealer warzonerat
- Async RAT payload
  rat
- Warzone RAT payload
  rat
- Drops file in Drivers directory
- Executes dropped EXE
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Drops startup file
- Loads dropped DLL
- Adds Run key to start application
  persistence
- Suspicious use of SetThreadContext
behavioral1 behavioral2