asyncrat

General

Target

luxurioux.exe
Size

6.5MB
Sample

230321-c9a2zage94
MD5

e43f5a6b060e95078d1bbab95dbf7a67
SHA1

5f6c18308a96a1c750d6f4e8b22dd7bec701f105
SHA256

969182320bfbad6534c5180717656b2bc2f09e8180c4b6f826ee2e63b9210027
SHA512

d40bded7052153008bbe5847133b06d64ab4ae3c28bd207a3f4f353babede35782334286c44465c76eb862e3d63b4752e772fb22a45d8f99f9dbb637caab07d8
SSDEEP

98304:gXc4No+9i3kwuwmX2qaaDvcrOobV1023br5I5S0fmw0NKg0yMgiPNIy6Ygl3qjZB:A/7+uSqa2dQBV+0ATPNO3EZ/zEM

Score

10^/10

Malware Config

Extracted

Family

asyncrat

Botnet

Default

C2

127.0.0.1:6606

127.0.0.1:7707

127.0.0.1:8808

https://api.telegram.org/bot5357505299:AAHKETAZ8bMFX4K83NsGaVH64EMVnQ3AS5U/sendMessage?chat_id=1725860085

Mutex

AsyncMutex_6SI8OkPnk

Attributes

delay
3
install
false
install_folder
%AppData%

aes.plain

Extracted

Family

bitrat

Version

1.38

C2

4napo6g3cp6av4hmxmwzi5lyojpfk3i2kl2tpssb2wvidqsa3kzo6eyd.onion:80

Attributes

communication_password
a47f89e7b85c1832b4df1ba9bfc8404f
install_dir
Chrome
install_file
Chrome.exe
tor_process
tor

Targets

- Target
  
  luxurioux.exe
- Size
  
  6.5MB
- MD5
  
  e43f5a6b060e95078d1bbab95dbf7a67
- SHA1
  
  5f6c18308a96a1c750d6f4e8b22dd7bec701f105
- SHA256
  
  969182320bfbad6534c5180717656b2bc2f09e8180c4b6f826ee2e63b9210027
- SHA512
  
  d40bded7052153008bbe5847133b06d64ab4ae3c28bd207a3f4f353babede35782334286c44465c76eb862e3d63b4752e772fb22a45d8f99f9dbb637caab07d8
- SSDEEP
  
  98304:gXc4No+9i3kwuwmX2qaaDvcrOobV1023br5I5S0fmw0NKg0yMgiPNIy6Ygl3qjZB:A/7+uSqa2dQBV+0ATPNO3EZ/zEM
Score

10^/10

asyncrat bitrat stormkitty default persistence rat spyware stealer trojan upx
- AsyncRat
  AsyncRAT is designed to remotely monitor and control other computers written in C#.
  rat asyncrat
- BitRAT
  BitRAT is a remote access tool written in C++ and uses leaked source code from other families.
  trojan bitrat
- StormKitty
  StormKitty is an open source info stealer written in C#.
  stealer stormkitty
- StormKitty payload
- Async RAT payload
  rat
- ACProtect 1.3x - 1.4x DLL software
  Detects file using ACProtect software.
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Loads dropped DLL
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
- Adds Run key to start application
  persistence
- Drops desktop.ini file(s)
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
- Looks up geolocation information via web service
  Uses a legitimate geolocation service to find the infected system's geolocation info.
- Suspicious use of NtSetInformationThreadHideFromDebugger
behavioral1 behavioral2