asyncrat

Sharing

Copy URL

Twitter E-mail

General

Target

1060.zip
Size

4.4MB
Sample

230117-mm4qwaae4z
MD5

4c238938f7e3b86351f1219f91728505
SHA1

2e9563d37a0ee8a40a92cde290a70d5a86409f6f
SHA256

d69eed54c20aded9d472b36b71b604f724b90038776e8a9bb34d994c319fafc9
SHA512

ccf6488c5ab9eb587f5a3e2ddbf6ab2523ee7c0365332eb3e572f96bd32fcba7cf12c28030894a687251ab2d6d639ecd5499ef16901cd63151f73a535db4fdcd
SSDEEP

98304:I8g5oJXZ7665fiPgpUNpLzTHgHBkqGri5VR68lKwFjKC9UBZd:vnJZT3pcV2BkqG76KwEC9+d

Score

10^/10

Malware Config

Extracted

Family

purecrypter

https://cdn.discordapp.com/attachments/1048713033821728872/1048726915747418154/Sqteas.png

http://185.246.220.210/Bhuqifrzkaz.png

Extracted

Family

asyncrat

Version

0.5.7B

Botnet

Default

127.0.0.1:2306

87.4.136.146:2306

Mutex

AsyncMutex_6SI8OkPnk

Attributes

delay
3
install
false
install_folder
%AppData%

aes.plain

Targets

- Target
  
  1060/0763daa2ef0dfb890d90bfd3f21e7a4252fb5c30a51e49904344a36012a79bac.bin
- Size
  
  244KB
- MD5
  
  459fc31c4d4e92a68f4e68df00c26d79
- SHA1
  
  5c4322ea964545c6ecd0bb75c8ec61319e2ef4e6
- SHA256
  
  0763daa2ef0dfb890d90bfd3f21e7a4252fb5c30a51e49904344a36012a79bac
- SHA512
  
  52d9a2422d657d13fd0f1efbae69dab14a4248344c858874e4b7f0f26982228dc6ec539d690619208b5fec2592f063fc7c648ac95153ae6cc106cbfa5605e315
- SSDEEP
  
  6144:fzfkEjF4rgDf908COGKyJfDpyZ8e4IUuZvUqD/wxk:fzfwsD
Score

10^/10

asyncrat default rat
- AsyncRat
  AsyncRAT is designed to remotely monitor and control other computers.
  rat asyncrat
- Async RAT payload
  rat
behavioral1 behavioral2
- Target
  
  1060/2b2bd717ef276aa3be519cb31fb4e498bb10242e110892bde18e28174bee5538.bin
- Size
  
  415KB
- MD5
  
  552911a7b0d4b3839ff7c63e5974b440
- SHA1
  
  03fe3f86ebf2116f4f0ca22eb61432a6c02c2011
- SHA256
  
  2b2bd717ef276aa3be519cb31fb4e498bb10242e110892bde18e28174bee5538
- SHA512
  
  dd9b020d73f70721f677c916f1d2801a0f0bcf510d9eae58f61e9afba3492b92a4e606db075fc35d3a4ac63ca9c2008c364b8c561be1f411161178bea626b3ce
- SSDEEP
  
  3072:KWymqz02O0zEr4cMwDqZ+wDqZ4wDqZHpP:KNrBuIZ
Score

8^/10

persistence
- Executes dropped EXE
- Registers COM server for autorun
  persistence
- Sets file execution options in registry
  persistence
- Loads dropped DLL
- Adds Run key to start application
  persistence
behavioral3 behavioral4
- Target
  
  1060/2c062e6674533b55f8fbcb316674ecd2a1ce8f71dacb55a2cebe248fc7445334.bin
- Size
  
  2.2MB
- MD5
  
  9a025c30044937f32ae8c97e725ea55b
- SHA1
  
  15f98c6a64a968c458ea731fac929104b6d23685
- SHA256
  
  2c062e6674533b55f8fbcb316674ecd2a1ce8f71dacb55a2cebe248fc7445334
- SHA512
  
  58eb93e3c296d3974d19c865a6d044c89d61e25732ffdac28620961de57d677aaab1f4c3f4d447fcdb1d225161ba5ff38901c34b0c8da4fe01ed23a7e81c65b8
- SSDEEP
  
  49152:BZpdZpvZpo+lZp/fouPaAkELZpEZpBZpwkZp:BZpdZpvZpo+lZp/wEaAkOZpEZpBZpfZp
Score

6^/10
- Legitimate hosting services abused for malware hosting/C2
behavioral5 behavioral6
- Target
  
  1060/364fb9545112672897e074456abf73a6031b313b2939d8eecec0813a5f096dba.bin
- Size
  
  1.1MB
- MD5
  
  e02aebe02cc62bd5646b4aa5edf81bfe
- SHA1
  
  290862deb1558c162725b2ef54e00491dbcf26ff
- SHA256
  
  364fb9545112672897e074456abf73a6031b313b2939d8eecec0813a5f096dba
- SHA512
  
  37dea18852bfaf65e4b29ce4e060b49a5ccee2fbaaaf8866e028e4d0aff65dc36d2452778fa455804515b23759aeb5bbe798187f468298d1e117a27a38c22415
- SSDEEP
  
  24576:4/W2+w7fZm2JSUpB+I/gmwqLY9HK9UnXW3ar9zd2R:4/W2+SfW061m
Score

1^/10
behavioral7 behavioral8
- Target
  
  1060/a4c4feb3d6679413553f96ab310e0a6d62f56a84b252a22d9d406f39cea5ea4b.bin
- Size
  
  7KB
- MD5
  
  bb46f8f73d6e24277069aaab748f15e3
- SHA1
  
  a6b6111790d9393f897d1cc4de5ec12049a56138
- SHA256
  
  a4c4feb3d6679413553f96ab310e0a6d62f56a84b252a22d9d406f39cea5ea4b
- SHA512
  
  80745f03082df5037368030b538f6a13a742d6bbeef48ab6c11a475ea2a48b244adffad1c13c3291d15744d4c8af3d24b68f0c2c9dcd525f4605d12f2a83f37b
- SSDEEP
  
  96:nIQcS3gOS1W9TlAORjgLggSOxfIuTOkfKANPkRPKjzNt:nIQl3nngLggSo1OkTMAl
Score

10^/10

purecrypter downloader loader
- PureCrypter
  PureCrypter is a .NET malware loader first seen in early 2021.
  loader downloader purecrypter
behavioral10 behavioral9
- Target
  
  1060/a50efe1f4ff14d891c56d3d15d60954945d3cfdac28d893ea14806ab17a147ab.bin
- Size
  
  8KB
- MD5
  
  ac5c5bc44f09cec9b707df067c452bf1
- SHA1
  
  0956102b8541466ea49e0339a815b73e8b795dbf
- SHA256
  
  a50efe1f4ff14d891c56d3d15d60954945d3cfdac28d893ea14806ab17a147ab
- SHA512
  
  230fba987d4e0530d83fd1c6986700a684cecef5dc809cf0a3d15f2230b70c6bc78cd25206b981254dda247890c9b11f7f3c756639cdfbf1d9d9806d5dd08863
- SSDEEP
  
  96:/jPAt8eyRWdIgfgRgux338H5cH8rO0HXI0BXskpKwpv1OwUhpQzNt:7ItpyRC9XuxcH5cJ0j18+v1Shpy
Score

1^/10
behavioral11 behavioral12
- Target
  
  1060/a5d4bab6184ba63aedcdbcb97666630f2b134de4a39ac0bcbcfe37b7a21b6416.bin
- Size
  
  2.5MB
- MD5
  
  5fc564f45184a5031c0d47911b89632c
- SHA1
  
  47827b266c89ea81ef493e772e08ab69693c305d
- SHA256
  
  a5d4bab6184ba63aedcdbcb97666630f2b134de4a39ac0bcbcfe37b7a21b6416
- SHA512
  
  70eb83ed3beb060cdbc4e66a13849599435757dbd5e3dab0fa92dadf1ccb6d9b5dc7c1ae42aca6b830787bad16233a0b907661fa4b4b6eadd06231ac5cbff728
- SSDEEP
  
  49152:+b5RCEaA15gKcDs8G2c4gM2IQQP7VBBJ3c6x8ET5daZ5LUbuOeY5R:+b5xx15gKcZGighIL7JJ3Ym5daZdjObR
Score

1^/10
behavioral13 behavioral14
- Target
  
  1060/d71d4f7a18e93069f0ad7c6631f49e122710fd4c66e4e91aa8c7c03dd4bc0d2a.bin
- Size
  
  13KB
- MD5
  
  002ece8b4fed339417ec90651c2ffd97
- SHA1
  
  5aeaffaa1e85c990b9a9949fa116e3f5fd32be7c
- SHA256
  
  d71d4f7a18e93069f0ad7c6631f49e122710fd4c66e4e91aa8c7c03dd4bc0d2a
- SHA512
  
  81c909c6dd349498bed3c1dba045741a280486ad5d6f643dbab0bb2693fe0f9f59932a1979d79083757a72032665c905875cd3ef0485e0e5a9cdbf9ecb619d5f
- SSDEEP
  
  192:g0A8xD9so8ZJtRgNJP/fCT6JI3a/95yNSSo0PKG22N6Zx2BpyYjkZ:gpaRso8Z/RgNpnCWJmaeNDkGrmcI
Score

3^/10
behavioral15 behavioral16
- Target
  
  1060/eb417ff8f23a6f69a05e39264cccd83c38e44cbdf4e90c5a6455800eb3d9c09c.bin
- Size
  
  7KB
- MD5
  
  55570910fb35bf9266cab6f5dd6649d4
- SHA1
  
  6591668a52dd77229fec598bff435d463620775e
- SHA256
  
  eb417ff8f23a6f69a05e39264cccd83c38e44cbdf4e90c5a6455800eb3d9c09c
- SHA512
  
  d7e2c9496eb7152f5f3df885ed1c9ca37449cf9491e719f99301fc393c98c0caeacf788232d8438faba9592b4576875837c9e866037a8f18106fdbb10f1259a4
- SSDEEP
  
  96:K/excS3gOdrA6Iqvj2bw5WARVAIU0GaDRo8azLfO2Q1uwub/keOShzNt:Nxl3e6D72ARV207DCbrouwuIaj
Score

10^/10

purecrypter downloader loader
- PureCrypter
  PureCrypter is a .NET malware loader first seen in early 2021.
  loader downloader purecrypter
behavioral17 behavioral18

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Web Service

T1102

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Extracted

Extracted

Targets

Async RAT payload

Executes dropped EXE

Registers COM server for autorun

Sets file execution options in registry

Loads dropped DLL

Adds Run key to start application

Legitimate hosting services abused for malware hosting/C2

PureCrypter

PureCrypter

MITRE ATT&CK Enterprise v6

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11

behavioral12

behavioral13

behavioral14

behavioral15

behavioral16

behavioral17

behavioral18