asyncrat

General

Target

d872fbe973a4799e94f57abdc594b37e
Size

475KB
Sample

230613-rqmzragf66
MD5

d872fbe973a4799e94f57abdc594b37e
SHA1

b16837fd4ce58947536360e301e985c7d37d6b1c
SHA256

11e3923cc252bb9022a41a9f5b73672ea8b0798e4492e603ac088d913d7c80c0
SHA512

772f155b664316993bfaa04f4fdf54d9f0b41f7a11ecb39bf7a9409f7afecf612f1ebdf2df7ef548b967291edee1e639d723b6e4c16fc0b36be414e45ac2d53f
SSDEEP

6144:w9TKnLFNE2Dg5PjGnBEYfzTFYIKwstHLzizUblgFBNc3d2RohDAF:w9TKDyxYfz5mwCH/iclgFBGNSoy

Score

10^/10

Malware Config

Extracted

Language

ps1

Deobfuscated

URLs

ps1.dropper

https://drive.google.com/uc?export=download&id=1yzIedgOlbPjUc006zFjrkRkJWDbchF0u

Extracted

Family

raccoon

rc4.plain

Extracted

Family

asyncrat

Version

1.0.7

Botnet

Default

C2

zerocool888.duckdns.org:8848

zerocool888.duckdns.org:8898

Mutex

DcRatMutex_imlegion

Attributes

delay
1
install
false
install_folder
%AppData%

aes.plain

Extracted

Family

remcos

Botnet

RemoteHost

C2

elpapa0810.mypsx.net:2024

Attributes

audio_folder
MicRecords
audio_record_time
5
connect_delay
0
connect_interval
1
copy_file
remcos.exe
copy_folder
Remcos
delete_file
false
hide_file
false
hide_keylog_file
false
install_flag
false
keylog_crypt
false
keylog_file
logs.dat
keylog_flag
false
keylog_folder
remcos
mouse_option
false
mutex
Rmc-6D8AYC
screenshot_crypt
false
screenshot_flag
false
screenshot_folder
Screenshots
screenshot_path
%AppData%
screenshot_time
10
startup_value
Remcos
take_screenshot_option
false
take_screenshot_time
5

Targets

- Target
  
  d872fbe973a4799e94f57abdc594b37e
- Size
  
  475KB
- MD5
  
  d872fbe973a4799e94f57abdc594b37e
- SHA1
  
  b16837fd4ce58947536360e301e985c7d37d6b1c
- SHA256
  
  11e3923cc252bb9022a41a9f5b73672ea8b0798e4492e603ac088d913d7c80c0
- SHA512
  
  772f155b664316993bfaa04f4fdf54d9f0b41f7a11ecb39bf7a9409f7afecf612f1ebdf2df7ef548b967291edee1e639d723b6e4c16fc0b36be414e45ac2d53f
- SSDEEP
  
  6144:w9TKnLFNE2Dg5PjGnBEYfzTFYIKwstHLzizUblgFBNc3d2RohDAF:w9TKDyxYfz5mwCH/iclgFBGNSoy
Score

10^/10

asyncrat lumma raccoon remcos default remotehost evasion persistence rat stealer trojan upx
- AsyncRat
  AsyncRAT is designed to remotely monitor and control other computers written in C#.
  rat asyncrat
- Lumma Stealer
  An infostealer written in C++ first seen in August 2022.
  stealer lumma
- Raccoon
  Raccoon is an infostealer written in C++ and first seen in 2019.
  stealer raccoon
- Remcos
  Remcos is a closed-source remote control and surveillance software.
  rat remcos
- Async RAT payload
  rat
- Blocklisted process makes network request
- Drops file in Drivers directory
- Modifies Installed Components in the registry
  persistence
- Sets file execution options in registry
  persistence
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Loads dropped DLL
- Registers COM server for autorun
  persistence
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
- Checks whether UAC is enabled
  evasion trojan
- Drops desktop.ini file(s)
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Legitimate hosting services abused for malware hosting/C2
- Drops file in System32 directory
- Suspicious use of SetThreadContext
behavioral1 behavioral2