General
-
Target
NEAS.83a08efeb3b8748e96c787399bbbc5a0_JC.exe
-
Size
45KB
-
Sample
231105-t2gyzsag35
-
MD5
83a08efeb3b8748e96c787399bbbc5a0
-
SHA1
14455741a4484a39fb55fd952e8782e942c9526b
-
SHA256
62fe5b9ab37bbb61c425200e3990bf29ea5de6796f2bfdfbb043450c8957798b
-
SHA512
8044db9aa272fbec73e0d2a58cc6d3a40c6d1159281a79ec24b2e67934af1bd6d110e8f08aa59375cbe3132d0938747d5bb281896aecac93a37b3a53e641e4cb
-
SSDEEP
768:ogO5RiCQqFx9spM0Qp8A7tfZjG0LgLF+79cOr6MOChUbWLH+:BO5RfQk9sptQp8Ava0eFI9br6MOCyW6
Malware Config
Extracted
xworm
5.0
188.148.105.135:2112
tcC0TAK6pKec3LNj
-
Install_directory
%ProgramData%
-
install_file
Craxs Loader.exe
-
telegram
https://api.telegram.org/bot6608139717:AAGt-zMdIdgdybfcDCcjI5c40PuzKHpy3kQ/sendMessage?chat_id=6468226445
Extracted
asyncrat
1.0.7 - modded by last
Default
188.148.105.135:3113
DcRatMutex_qwqdanchun
-
delay
1
-
install
true
-
install_file
systray.exe
-
install_folder
%AppData%
Targets
-
-
Target
NEAS.83a08efeb3b8748e96c787399bbbc5a0_JC.exe
-
Size
45KB
-
MD5
83a08efeb3b8748e96c787399bbbc5a0
-
SHA1
14455741a4484a39fb55fd952e8782e942c9526b
-
SHA256
62fe5b9ab37bbb61c425200e3990bf29ea5de6796f2bfdfbb043450c8957798b
-
SHA512
8044db9aa272fbec73e0d2a58cc6d3a40c6d1159281a79ec24b2e67934af1bd6d110e8f08aa59375cbe3132d0938747d5bb281896aecac93a37b3a53e641e4cb
-
SSDEEP
768:ogO5RiCQqFx9spM0Qp8A7tfZjG0LgLF+79cOr6MOChUbWLH+:BO5RfQk9sptQp8Ava0eFI9br6MOCyW6
Score10/10-
AsyncRat
AsyncRAT is designed to remotely monitor and control other computers written in C#.
-
Detect Xworm Payload
-
XenArmor Suite
XenArmor is as suite of password recovery tools for various application.
-
Xworm
Xworm is a remote access trojan written in C#.
-
Async RAT payload
-
ACProtect 1.3x - 1.4x DLL software
Detects file using ACProtect software.
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Drops startup file
-
Executes dropped EXE
-
Loads dropped DLL
-
Reads data files stored by FTP clients
Tries to access configuration files associated with programs like FileZilla.
-
Reads local data of messenger clients
Infostealers often target stored data of messaging applications, which can include saved credentials and account information.
-
Reads user/profile data of local email clients
Email clients store some user data on disk where infostealers will often target it.
-
Reads user/profile data of web browsers
Infostealers often target stored browser data, which can include saved credentials etc.
-
UPX packed file
Detects executables packed with UPX/modified UPX open source packer.
-
Accesses Microsoft Outlook accounts
-
Adds Run key to start application
-
Looks up external IP address via web service
Uses a legitimate IP lookup service to find the infected system's external IP.
-