asyncrat

General

Target

969182320bfbad6534c5180717656b2bc2f09e8180c4b6f826ee2e63b9210027.zip
Size

6.4MB
Sample

230321-rwg1pada9w
MD5

9d2dd8e33de8fa3643c4609e8f34714f
SHA1

9a8fddb9669401d9503a8cfada570eec5a6754c5
SHA256

c914c92eeaaec32a3ec29bf94da3ddbdecfa46257b808165cf86ac6ec6b0a87e
SHA512

f2b54b15b148ce7405367983c2f3e6963510a3f644febb9aa72e56ce15e14d5408fc5aea3e60cc85a7ca0ebfd8020f1d34bd2f5948d151288f25b3d6a70b1915
SSDEEP

98304:ShZnobP5jGXEHQlAIVdC9XHpZOzriEdJJxSzwv8ag3BtP9RDbdRL10s9GIBERS8I:qotjUEAVdkTWuoJJxSON4n9LBiSqo6a

Score

10^/10

Malware Config

Extracted

Family

asyncrat

Botnet

Default

C2

127.0.0.1:6606

127.0.0.1:7707

127.0.0.1:8808

https://api.telegram.org/bot5357505299:AAHKETAZ8bMFX4K83NsGaVH64EMVnQ3AS5U/sendMessage?chat_id=1725860085

Mutex

AsyncMutex_6SI8OkPnk

Attributes

delay
3
install
false
install_folder
%AppData%

aes.plain

Extracted

Family

bitrat

Version

1.38

C2

4napo6g3cp6av4hmxmwzi5lyojpfk3i2kl2tpssb2wvidqsa3kzo6eyd.onion:80

Attributes

communication_password
a47f89e7b85c1832b4df1ba9bfc8404f
install_dir
Chrome
install_file
Chrome.exe
tor_process
tor

Targets

- Target
  
  969182320bfbad6534c5180717656b2bc2f09e8180c4b6f826ee2e63b9210027.exe
- Size
  
  6.5MB
- MD5
  
  e43f5a6b060e95078d1bbab95dbf7a67
- SHA1
  
  5f6c18308a96a1c750d6f4e8b22dd7bec701f105
- SHA256
  
  969182320bfbad6534c5180717656b2bc2f09e8180c4b6f826ee2e63b9210027
- SHA512
  
  d40bded7052153008bbe5847133b06d64ab4ae3c28bd207a3f4f353babede35782334286c44465c76eb862e3d63b4752e772fb22a45d8f99f9dbb637caab07d8
- SSDEEP
  
  98304:gXc4No+9i3kwuwmX2qaaDvcrOobV1023br5I5S0fmw0NKg0yMgiPNIy6Ygl3qjZB:A/7+uSqa2dQBV+0ATPNO3EZ/zEM
Score

10^/10

asyncrat bitrat stormkitty default persistence rat spyware stealer trojan upx
- AsyncRat
  AsyncRAT is designed to remotely monitor and control other computers written in C#.
  rat asyncrat
- BitRAT
  BitRAT is a remote access tool written in C++ and uses leaked source code from other families.
  trojan bitrat
- StormKitty
  StormKitty is an open source info stealer written in C#.
  stealer stormkitty
- StormKitty payload
- Async RAT payload
  rat
- ACProtect 1.3x - 1.4x DLL software
  Detects file using ACProtect software.
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Loads dropped DLL
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
- Adds Run key to start application
  persistence
- Drops desktop.ini file(s)
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
- Looks up geolocation information via web service
  Uses a legitimate geolocation service to find the infected system's geolocation info.
- Suspicious use of NtSetInformationThreadHideFromDebugger
behavioral1 behavioral2