asyncrat

General

Target

88262a78ce91985653afffc74d9938050e56113840efbc67ee98eb9483fe1f22
Size

539KB
Sample

230317-hqg9tsgg2s
MD5

04694e5e78d0a3dcab0bfea22aa90cfe
SHA1

bbc04877ba04814fa13800b42f6e8ea550967e2b
SHA256

88262a78ce91985653afffc74d9938050e56113840efbc67ee98eb9483fe1f22
SHA512

953a8df5135738fcda2e47b5f63e6ad626dada1f8485fd587997c38e307fe7bd34ccc5c0164f8c25dbbf63038ea126ef44445d31c4607731ba4a692524b13c9c
SSDEEP

12288:UdXvDWopdu11GNJGUOXOoDscvVqILhtgpiEg/ojnSFRsQOoS9cwMd:gv6oLM2GvXOoHdqIdsg/ojn4sQ9S9c1

Score

10^/10

Malware Config

Extracted

Family

asyncrat

Version

0.5.7B

Botnet

Wars

C2

95.173.247.110:8806

Mutex

Wars

Attributes

delay
3
install
true
install_file
Winder.exe
install_folder
%AppData%

aes.plain

Extracted

Family

redline

Botnet

Muck

C2

52.232.8.179:37764

Extracted

Family

asyncrat

Version

0.5.7B

Botnet

DefenderSmartScren

C2

217.64.31.3:8437

Mutex

DefenderSmartScren

Attributes

delay
3
install
false
install_file
SecurityHealtheurvice.exe
install_folder
%AppData%

aes.plain

Extracted

Family

asyncrat

Version

0.5.7B

Botnet

SecurityDefenderProtokol

C2

88.248.18.120:33918

Mutex

SecurityDefenderProtokol

Attributes

delay
3
install
false
install_file
SecurityDefenderProtokol.exe
install_folder
%AppData%

aes.plain

Extracted

Family

asyncrat

Version

1.0.7

C2

217.64.31.3:9742

Mutex

WindowsDefenderSmarttScreen

Attributes

delay
1
install
false
install_file
WindowsDefenderSmarttScreen.exe
install_folder
%AppData%

aes.plain

Targets

- Target
  
  88262a78ce91985653afffc74d9938050e56113840efbc67ee98eb9483fe1f22
- Size
  
  539KB
- MD5
  
  04694e5e78d0a3dcab0bfea22aa90cfe
- SHA1
  
  bbc04877ba04814fa13800b42f6e8ea550967e2b
- SHA256
  
  88262a78ce91985653afffc74d9938050e56113840efbc67ee98eb9483fe1f22
- SHA512
  
  953a8df5135738fcda2e47b5f63e6ad626dada1f8485fd587997c38e307fe7bd34ccc5c0164f8c25dbbf63038ea126ef44445d31c4607731ba4a692524b13c9c
- SSDEEP
  
  12288:UdXvDWopdu11GNJGUOXOoDscvVqILhtgpiEg/ojnSFRsQOoS9cwMd:gv6oLM2GvXOoHdqIdsg/ojn4sQ9S9c1
Score

10^/10

asyncrat redline sectoprat defendersmartscren muck securitydefenderprotokol wars discovery infostealer persistence rat spyware stealer trojan upx
- AsyncRat
  AsyncRAT is designed to remotely monitor and control other computers written in C#.
  rat asyncrat
- RedLine
  RedLine Stealer is a malware family written in C#, first appearing in early 2020.
  infostealer redline
- RedLine payload
- SectopRAT
  SectopRAT is a remote access trojan first seen in November 2019.
  trojan rat sectoprat
- SectopRAT payload
- Async RAT payload
  rat
- Blocklisted process makes network request
- Downloads MZ/PE file
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Drops startup file
- Executes dropped EXE
- Loads dropped DLL
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
- Accesses cryptocurrency files/wallets, possible credential harvesting
  spyware
- Adds Run key to start application
  persistence
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
- Suspicious use of SetThreadContext
behavioral1