asyncrat

General

Target

532460789536784236784367345678543678.exe
Size

48KB
Sample

230329-xr3dqahe79
MD5

8db2a00346e1f71bbef2ee20782bbd06
SHA1

d4268a671b6799d9788915ce18ef3374da3ed0bd
SHA256

d0279ffc1699fc3ea4bf32245326f6eb7dbc78aa14e221e7369c7131b057c4ff
SHA512

d5720550ce290051eab4554a614e230e1a78084526ce45c1e70545d164ce3211a6932846d5dca89471bffd06a4fbd719aa9b853d14c32787abe90bcad301a528
SSDEEP

768:Z9umxLiIL1CaS+Dimhs1+Ei7dYbIgeGTTQhvEgK/JzZVc6KN:Z9uAPWm++rmbf5TGnkJzZVclN

Score

10^/10

Malware Config

Extracted

Family

asyncrat

Version

1.0.7

Botnet

Default

C2

127.0.0.1:8848

127.0.0.1:33901

spring-consultation.at.ply.gg:8848

spring-consultation.at.ply.gg:33901

Mutex

DcRatMutex_qwqdanchun

Attributes

delay
1
install
false
install_folder
%AppData%

aes.plain

Extracted

Path

\??\c:\users\admin\appdata\@please_read_me@.txt

Family

wannacry

Ransom Note

Q: What's wrong with my files? A: Ooops, your important files are encrypted. It means you will not be able to access them anymore until they are decrypted. If you follow our instructions, we guarantee that you can decrypt all your files quickly and safely! Let's start decrypting! Q: What do I do? A: First, you need to pay service fees for the decryption. Please send $300 worth of bitcoin to this bitcoin address: 12t9YDPgwueZ9NyMgw519p7AA8isjr6SMw Next, please find an application file named "@WanaDecryptor@.exe". It is the decrypt software. Run and follow the instructions! (You may need to disable your antivirus for a while.) Q: How can I trust? A: Don't worry about decryption. We will decrypt your files surely because nobody will trust us if we cheat users. * If you need our assistance, send a message by clicking <Contact Us> on the decryptor window. �

Wallets

12t9YDPgwueZ9NyMgw519p7AA8isjr6SMw

Targets

- Target
  
  532460789536784236784367345678543678.exe
- Size
  
  48KB
- MD5
  
  8db2a00346e1f71bbef2ee20782bbd06
- SHA1
  
  d4268a671b6799d9788915ce18ef3374da3ed0bd
- SHA256
  
  d0279ffc1699fc3ea4bf32245326f6eb7dbc78aa14e221e7369c7131b057c4ff
- SHA512
  
  d5720550ce290051eab4554a614e230e1a78084526ce45c1e70545d164ce3211a6932846d5dca89471bffd06a4fbd719aa9b853d14c32787abe90bcad301a528
- SSDEEP
  
  768:Z9umxLiIL1CaS+Dimhs1+Ei7dYbIgeGTTQhvEgK/JzZVc6KN:Z9uAPWm++rmbf5TGnkJzZVclN
Score

10^/10

asyncrat default evasion rat spyware stealer wannacry discovery ransomware trojan worm
- AsyncRat
  AsyncRAT is designed to remotely monitor and control other computers written in C#.
  rat asyncrat
- Modifies Windows Defender Real-time Protection settings
  evasion trojan
- Wannacry
  WannaCry is a ransomware cryptoworm.
  ransomware worm wannacry
- Async RAT payload
  rat
- Grants admin privileges
  Uses net.exe to modify the user's privileges.
- Modifies Windows Firewall
  evasion
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Modifies file permissions
  discovery
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Windows security modification
  evasion trojan
behavioral1 behavioral2