asyncrat

Resubmissions

08-04-2023 15:54

230408-tcfdvsdh99 7

28-01-2023 14:39

28-01-2023 12:12

28-01-2023 11:33

28-01-2023 11:17

Sharing

Copy URL

Twitter E-mail

General

Target

Hwid Spoofer Eac Rust Cleaner‮nls..scr
Size

658KB
Sample

230128-r1rqpagf4t
MD5

556084cf64aec63e0babdf10a61afaa6
SHA1

b7fa21295db0657d1767c05bb440b218cecdf521
SHA256

d016fcbdb988d56df4c26d75a12e87a61010ed2366b52eefb8b409a1d8bcbaab
SHA512

6c896594ea47228f71f1dea7d9fd9f9842b5f178748a39c785ded34fb9dfd574c9bd781f1f65176e436453257078255803d729b79d823c01c6629fddfb3ce33e
SSDEEP

12288:LC/74rdbHgVBnqvFprkrUolVATWZXYm7ljg9hG80NEKXo1Y1UHC+O:LC/UGTWrkrUovUKfhkQNEwUnO

Score

10^/10

asyncrat redline defendersmartscren ff securityhealthservice system guard runtime whostprojess windoosdguard discovery infostealer persistence rat spyware stealer upx

Malware Config

Extracted

Family

redline

Botnet

51.103.208.104:53200

Extracted

Family

asyncrat

Version

0.5.7B

Botnet

WHostProjess

95.70.151.185:8805

Mutex

WHostProjess

Attributes

delay
3
install
false
install_file
WHostProjess
install_folder
%AppData%

aes.plain

Extracted

Family

asyncrat

Version

0.5.7B

Botnet

SecurityHealthService

20.4.6.16:43521

Mutex

SecurityHealthService

Attributes

delay
3
install
false
install_file
SecurityHealthService
install_folder
%AppData%

aes.plain

Extracted

Family

asyncrat

Version

0.5.7B

Botnet

WindoosDGuard

20.4.6.16:43521

Mutex

WindoosDGuard

Attributes

delay
3
install
false
install_file
WindoosDGuard
install_folder
%AppData%

aes.plain

Extracted

Family

asyncrat

Version

0.5.7B

Botnet

DefenderSmartScren

217.64.31.3:8437

Mutex

DefenderSmartScren

Attributes

delay
3
install
false
install_file
SecurityHealtheurvice.exe
install_folder
%AppData%

aes.plain

Extracted

Family

asyncrat

Version

0.5.7B

Botnet

System Guard Runtime

85.105.88.221:2531

Mutex

System Guard Runtime

Attributes

delay
3
install
false
install_file
System Guard Runtime
install_folder
%AppData%

aes.plain

Targets

- Target
  
  Hwid Spoofer Eac Rust Cleaner‮nls..scr
- Size
  
  658KB
- MD5
  
  556084cf64aec63e0babdf10a61afaa6
- SHA1
  
  b7fa21295db0657d1767c05bb440b218cecdf521
- SHA256
  
  d016fcbdb988d56df4c26d75a12e87a61010ed2366b52eefb8b409a1d8bcbaab
- SHA512
  
  6c896594ea47228f71f1dea7d9fd9f9842b5f178748a39c785ded34fb9dfd574c9bd781f1f65176e436453257078255803d729b79d823c01c6629fddfb3ce33e
- SSDEEP
  
  12288:LC/74rdbHgVBnqvFprkrUolVATWZXYm7ljg9hG80NEKXo1Y1UHC+O:LC/UGTWrkrUovUKfhkQNEwUnO
Score

10^/10

asyncrat redline defendersmartscren ff securityhealthservice system guard runtime whostprojess windoosdguard discovery infostealer persistence rat spyware stealer upx
- AsyncRat
  AsyncRAT is designed to remotely monitor and control other computers.
  rat asyncrat
- RedLine
  RedLine Stealer is a malware family written in C#, first appearing in early 2020.
  infostealer redline
- RedLine payload
- Async RAT payload
  rat
- Blocklisted process makes network request
- Downloads MZ/PE file
- Executes dropped EXE
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Accesses cryptocurrency files/wallets, possible credential harvesting
  spyware
- Adds Run key to start application
  persistence
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
- Suspicious use of SetThreadContext
behavioral1