asyncrat

General

Target

JC_75f1b83365dc9f8867aae86d9b8234f544d0b193743bfb012d31a258652d2bc4
Size

207KB
Sample

230902-nnmdnacf89
MD5

29f9c469d2695d3d90204fd2f7226efd
SHA1

4ec4b5892bbeac6e37e8c609b54648bf40a123bb
SHA256

75f1b83365dc9f8867aae86d9b8234f544d0b193743bfb012d31a258652d2bc4
SHA512

b29421b982a1801ecb957c2868c9987c187979258f16e3493f2456e8ffaa0cee78da4129aba2b2e726351ba807ec813eaa5a375b36c24f2035a6eb0cd503f7cc
SSDEEP

3072:rDVjvYR+L4xC/yx9J2pJgZwl36OkjfWVEEcoTyYR:fCR+L4CMqBN6Ok6VeM9

Score

10^/10

Malware Config

Extracted

Family

smokeloader

Botnet

summ

Extracted

Family

smokeloader

Version

2022

C2

http://stalagmijesarl.com/

http://ukdantist-sarl.com/

http://cpcorprotationltd.com/

rc4.i32

Extracted

Family

redline

Botnet

installs

C2

162.55.189.218:26952

Attributes

auth_value
4bdfa4191a2826ff2af143a4691bab78

Extracted

Family

asyncrat

Botnet

Default

C2

127.0.0.1:6606

127.0.0.1:7707

127.0.0.1:8808

https://api.telegram.org/bot6538641198:AAHYdHyZFemLu-2_NIdt0LLw-uxUuxXCPOY/sendMessage?chat_id=5786978836

Mutex

AsyncMutex_6SI8OkPnk

Attributes

delay
3
install
false
install_folder
%AppData%

aes.plain

Targets

- Target
  
  JC_75f1b83365dc9f8867aae86d9b8234f544d0b193743bfb012d31a258652d2bc4
- Size
  
  207KB
- MD5
  
  29f9c469d2695d3d90204fd2f7226efd
- SHA1
  
  4ec4b5892bbeac6e37e8c609b54648bf40a123bb
- SHA256
  
  75f1b83365dc9f8867aae86d9b8234f544d0b193743bfb012d31a258652d2bc4
- SHA512
  
  b29421b982a1801ecb957c2868c9987c187979258f16e3493f2456e8ffaa0cee78da4129aba2b2e726351ba807ec813eaa5a375b36c24f2035a6eb0cd503f7cc
- SSDEEP
  
  3072:rDVjvYR+L4xC/yx9J2pJgZwl36OkjfWVEEcoTyYR:fCR+L4CMqBN6Ok6VeM9
Score

10^/10

asyncrat redline smokeloader stormkitty default installs summ backdoor infostealer rat spyware stealer trojan
- AsyncRat
  AsyncRAT is designed to remotely monitor and control other computers written in C#.
  rat asyncrat
- RedLine
  RedLine Stealer is a malware family written in C#, first appearing in early 2020.
  infostealer redline
- SmokeLoader
  Modular backdoor trojan in use since 2014.
  trojan backdoor smokeloader
- StormKitty
  StormKitty is an open source info stealer written in C#.
  stealer stormkitty
- StormKitty payload
- Async RAT payload
  rat
- Downloads MZ/PE file
- Deletes itself
- Executes dropped EXE
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Uses the VBS compiler for execution
- Drops desktop.ini file(s)
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
- Looks up geolocation information via web service
  Uses a legitimate geolocation service to find the infected system's geolocation info.
- Suspicious use of SetThreadContext
behavioral1 behavioral2