General
-
Target
https://textbin.net/raw/luqdmpl0hv
-
Sample
230119-q4gt8agb46
Malware Config
Extracted
redline
Muckk
3.66.213.216:60782
Extracted
asyncrat
0.5.7B
WHostProjess
95.70.151.185:8805
WHostProjess
-
delay
3
-
install
false
-
install_file
WHostProjess
-
install_folder
%AppData%
Extracted
asyncrat
0.5.7B
UWUISCOMIC
20.100.196.69:9281
UWUISCOMIC
-
delay
3
-
install
false
-
install_file
DerenderScuriry
-
install_folder
%AppData%
Extracted
asyncrat
0.5.7B
DefenderSmartScren
217.64.31.3:8437
DefenderSmartScren
-
delay
3
-
install
false
-
install_file
SecurityHealtheurvice.exe
-
install_folder
%AppData%
Targets
-
-
Target
https://textbin.net/raw/luqdmpl0hv
Score10/10-
AsyncRat
AsyncRAT is designed to remotely monitor and control other computers.
-
Modifies system executable filetype association
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine payload
-
Async RAT payload
-
Blocklisted process makes network request
-
Downloads MZ/PE file
-
Executes dropped EXE
-
Registers COM server for autorun
-
UPX packed file
Detects executables packed with UPX/modified UPX open source packer.
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Reads user/profile data of web browsers
Infostealers often target stored browser data, which can include saved credentials etc.
-
Accesses cryptocurrency files/wallets, possible credential harvesting
-
Adds Run key to start application
-
Checks installed software on the system
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Suspicious use of SetThreadContext
-