asyncrat

General

Target

4a35d67996cdcde8da42ba8e40015738.bin
Size

601KB
Sample

230227-bpap2abc75
MD5

6b6d43a00598cc5bcef99c98f72ffb84
SHA1

8d2464bf6913b8ae794f53fd4247262d0884a0c2
SHA256

8d73747ba178784cf760985cb4254b8d178ec2a8ce07b58e782fcd3cd40ada51
SHA512

83cd51c02c508bdce3f8b76f6da9c61b7059c308eddd16b15ab851180697865174d525331fcc1916fc1f265ce054bb64cb4d463d8a3beef4c7cf60c8bff3f279
SSDEEP

12288:f00wQdW6ZlBcS3zEwzvKvV+JZI0+zLGf8K/1B9GYa2J8l0r:ZWEkSzTu8JZT+zLKN/AsF

Score

10^/10

Malware Config

Extracted

Family

asyncrat

Version

0.5.7B

Botnet

DefenderSmartScren

C2

217.64.31.3:8437

Mutex

DefenderSmartScren

Attributes

delay
3
install
false
install_file
SecurityHealtheurvice.exe
install_folder
%AppData%

aes.plain

Extracted

Family

asyncrat

Version

1.0.7

Botnet

WindowsDefenderSmarttScreen

C2

217.64.31.3:9742

Mutex

WindowsDefenderSmarttScreen

Attributes

delay
1
install
false
install_file
WindowsDefenderSmarttScreen.exe
install_folder
%AppData%

aes.plain

Extracted

Family

asyncrat

Version

0.5.7B

Botnet

LWRTX

C2

20.199.101.68:3161

Mutex

LWRTX

Attributes

delay
3
install
false
install_file
LWRTX
install_folder
%AppData%

aes.plain

Targets

- Target
  
  76a794c86b0f80ae8ec3461e05e0fb0fb219e57f7e85ebdae3cc10901a99791c.exe
- Size
  
  622KB
- MD5
  
  4a35d67996cdcde8da42ba8e40015738
- SHA1
  
  21342be12a055a2c1caffd73cc7866c81cb3e585
- SHA256
  
  76a794c86b0f80ae8ec3461e05e0fb0fb219e57f7e85ebdae3cc10901a99791c
- SHA512
  
  96f3904de25540397b1a499828f1781c943ffba4d42e2028b6ab322dbb3916bc03adf5ca084bf2afa3a90272a9c986e7d11b23e26ab86856225b0d0aef9f8ad2
- SSDEEP
  
  12288:U/C3Xp1sthiBKo+NJv9B3K6EwC2EQcmowOmA9BRMsrLS3t5r0I1Uu:e+Xp14hiBr+NJDvEwFQBPMqLS3kIC
Score

10^/10

upx asyncrat redline defendersmartscren lwrtx windowsdefendersmarttscreen discovery infostealer persistence rat spyware stealer
- AsyncRat
  AsyncRAT is designed to remotely monitor and control other computers.
  rat asyncrat
- RedLine
  RedLine Stealer is a malware family written in C#, first appearing in early 2020.
  infostealer redline
- Async RAT payload
  rat
- Blocklisted process makes network request
- Downloads MZ/PE file
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Loads dropped DLL
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
- Accesses cryptocurrency files/wallets, possible credential harvesting
  spyware
- Adds Run key to start application
  persistence
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
- Legitimate hosting services abused for malware hosting/C2
- Suspicious use of SetThreadContext
behavioral1 behavioral2