asyncrat

General

Target
ws.exe
Size 3.0MB
Sample230116-vejpqsaa96
SHA256 430d855fc783133d2d5bc01c095baff7d8b416a0f7c15a8a59288a96fcee7aa1
MD5 c9a81dcabe30d055caca7db9affe0248
SHA1 0e13ed377b15349ddef95c6eed281b46a50bbb5f
SHA512 4bb62f936e94c207715aa9bf854dda8c5d0aa4a50d97ac09df98721344e0d0ed85f4c77f03e067bceb052fa908335ad1d34648a2afe5b3fac81873e55b49566a
SSDEEP 49152:ug2G6sHJRXRTV7PH/4lrezRSmI4/6SWOyg5eO09rAq3h7twjklRUsd8OLWB7C7Rq:WG6sZVjVRSmI4eg5ebrV35ijsdLWBERq
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

Malware Config

Extracted

Family

asyncrat

Botnet

Default

C2

127.0.0.1:6606
127.0.0.1:7707
127.0.0.1:8808
https://api.telegram.org/bot5980420064:AAHGrlOU2WsgF90Pcyz-L7wrGgC_Cj54k4Q/sendMessage?chat_id=806259874

Mutex

AsyncMutex_6SI8OkPnk

Attributes

delay
3
install
false
install_folder
%AppData%

aes.plain

Targets

- Target
  ws.exe
- Size 3.0MB
- SHA256 430d855fc783133d2d5bc01c095baff7d8b416a0f7c15a8a59288a96fcee7aa1
- MD5 c9a81dcabe30d055caca7db9affe0248
- SHA1 0e13ed377b15349ddef95c6eed281b46a50bbb5f
- SHA512 4bb62f936e94c207715aa9bf854dda8c5d0aa4a50d97ac09df98721344e0d0ed85f4c77f03e067bceb052fa908335ad1d34648a2afe5b3fac81873e55b49566a
- SSDEEP 49152:ug2G6sHJRXRTV7PH/4lrezRSmI4/6SWOyg5eO09rAq3h7twjklRUsd8OLWB7C7Rq:WG6sZVjVRSmI4eg5ebrV35ijsdLWBERq
- MD5 SHA1 SHA512 SSDEEP
Score

10^/10

asyncrat stormkitty default evasion rat spyware stealer themida trojan
- AsyncRat
  AsyncRAT is designed to remotely monitor and control other computers.
  rat asyncrat
- StormKitty
  StormKitty is an open source info stealer written in C#.
  stealer stormkitty
- StormKitty payload
- Async RAT payload
  rat
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
  evasion
- Checks BIOS information in registry
  BIOS information is often read in order to detect sandboxing environments.
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Themida packer
  Detects Themida, an advanced Windows software protection system.
  themida
- Checks whether UAC is enabled
  evasion trojan
- Drops desktop.ini file(s)
- Legitimate hosting services abused for malware hosting/C2
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
- Looks up geolocation information via web service
  Uses a legitimate geolocation service to find the infected system's geolocation info.
- Suspicious use of NtSetInformationThreadHideFromDebugger
behavioral1 behavioral2