asyncrat

Resubmissions

23-09-2023 06:20

230923-g3294afc74 6

22-09-2023 09:24

21-09-2023 15:40

19-09-2023 16:03

19-09-2023 13:37

19-09-2023 13:25

13-09-2023 11:47

12-09-2023 19:11

12-09-2023 19:03

12-09-2023 11:47

Sharing

Copy URL

Twitter E-mail

General

Target

https://google.com
Sample

230909-rkhg3sbg35

Score

10^/10

Malware Config

Extracted

Family

asyncrat

Version

1.0.7

Botnet

def

37.18.62.18:8060

Mutex

era2312swe12-1213rsgdkms23

Attributes

delay
1
install
true
install_file
CCXProcess.exe
install_folder
%Temp%

aes.plain

Extracted

Family

toxiceye

https://api.telegram.org/bot5687152406:AAFin_LYFhJGLydMgYheeUDec-2orew51aM/sendMessage?chat_id=2024893777

Targets

- Target
  
  https://google.com
Score

10^/10

asyncrat toxiceye def agilenet persistence rat trojan
- AsyncRat
  AsyncRAT is designed to remotely monitor and control other computers written in C#.
  rat asyncrat
- ToxicEye
  ToxicEye is a trojan written in C#.
  rat trojan toxiceye
- Async RAT payload
  rat
- Modifies Installed Components in the registry
  persistence
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Loads dropped DLL
- Obfuscated with Agile.Net obfuscator
  Detects use of the Agile.Net commercial obfuscator, which is capable of entity renaming and control flow obfuscation.
  agilenet
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Suspicious use of SetThreadContext
behavioral1