asyncrat

General

Target
IMG_Mia_khalifa.zip
Size 1.1MB
Sample240214-qcf4lsce66
SHA256 2bb78975b6f2b6dddf174256af15046bfb86d8438d14afb004d6bddaa6eaa7a3
MD5 37e4a3ad05c378f682823e0120a78dbd
SHA1 987b36d1edac74cc316727bebe349144b1a59817
SHA512 931361c592312973c5098fdb85ce21a2d6e84d63ba78eb2abac8538a47a0b57fa5b58d206076cf39894961c023064012e2c9bef80cba13a58c9b9215edabcb2b
SSDEEP 24576:Kaql/twdUiH7rEFV5TD2WlMIc8ZaNi7urmCoDhD:KxtwDMD2dIDuYurmCGhD
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

Malware Config

Extracted

Family

asyncrat

Version

1.0.7

Botnet

JALEL

C2

141.95.84.40:6262

Mutex

ass3e22d242

Attributes

delay
1
install
false
install_folder
%AppData%

aes.plain

Extracted

Family

remcos

Botnet

NICEEEEEEEEEEEEEE

C2

141.95.84.40:3939

Attributes

audio_folder
MicRecords
audio_record_time
5
connect_delay
0
connect_interval
1
copy_file
remcos.exe
copy_folder
Remcos
delete_file
false
hide_file
false
hide_keylog_file
false
install_flag
false
keylog_crypt
false
keylog_file
logs.dat
keylog_flag
false
keylog_folder
remcos
mouse_option
false
mutex
acwaw2-S0GXDB
screenshot_crypt
false
screenshot_flag
false
screenshot_folder
Screenshots
screenshot_path
%AppData%
screenshot_time
10
take_screenshot_option
false
take_screenshot_time
5

Extracted

Family

remcos

Botnet

Newsss

C2

141.95.84.40:4090

Attributes

audio_folder
MicRecords
audio_record_time
5
connect_delay
0
connect_interval
1
copy_file
remcos.exe
copy_folder
Remcos
delete_file
false
hide_file
false
hide_keylog_file
false
install_flag
false
keylog_crypt
false
keylog_file
logs.dat
keylog_flag
false
keylog_folder
remcos
mouse_option
false
mutex
awcvvwvvwa-MZS2PC
screenshot_crypt
false
screenshot_flag
false
screenshot_folder
Screenshots
screenshot_path
%AppData%
screenshot_time
10
startup_value
Remcos
take_screenshot_option
false
take_screenshot_time
5

Extracted

Family

remcos

Botnet

AUS

C2

141.95.84.40:3636

Attributes

audio_folder
MicRecords
audio_record_time
5
connect_delay
0
connect_interval
1
copy_file
remcos.exe
copy_folder
Remcos
delete_file
false
hide_file
false
hide_keylog_file
false
install_flag
false
keylog_crypt
false
keylog_file
logs.dat
keylog_flag
false
keylog_folder
remcos
mouse_option
false
mutex
asasasasasadtssrsar-SCM43H
screenshot_crypt
false
screenshot_flag
false
screenshot_folder
Screenshots
screenshot_path
%AppData%
screenshot_time
10
take_screenshot_option
false
take_screenshot_time
5

Targets

- Target
  '
- Size 1.1MB
- SHA256 0d45142d18f84428028e9e4ee2e0b6c908c39ed595193c439cdbf49a3a5c4d36
- MD5 55ee7d1ae38f39d78ad5456dfe691702
- SHA1 2ba5e851f81a129f9c871e2514f99e0cfdd7fdea
- SHA512 ffcea00a588eed0e54c4602539497f3f682845f962d5ad71b55509a668900c04a99157de73052542cf70c0b8d6582ef99fc5cfc8ea4aa05afb967a34e246a2c7
- SSDEEP 24576:v88Udc4fIakIASsBUQ03Lac8LQTCZ3XrvRuivcAERclDb:Yi5Ux3LaDyAXrRcAEihb
- MD5 SHA1 SHA512 SSDEEP
Score

1^/10
behavioral1 behavioral2
- Target
  IMG_Mia_khalifa.vbs
- Size 66KB
- SHA256 440f67049c65c6ccea66578f2901285c0609c3b1cfc56a16740e670d19a92ba9
- MD5 3033d0f6444d48470e9c1f71905cadc4
- SHA1 ec43dfec6afaa79cb4656cf673be24e247ec9821
- SHA512 073336124cd6c6821389d2b95634fbd7c50b984a6d7b8b8891ee9d6356c3523302e2fc8b137e6f5e2652d3cb7420763ef4c27a91cfd215ee27f32cf6c0a947b0
- SSDEEP 1536:N5u5FjaXGxbMN75ro6BHB1ZFqvKHNrnXy2u0L3Jaa:ziQ5xNj5aa
- MD5 SHA1 SHA512 SSDEEP
Score

10^/10

asyncrat remcos aus jalel newsss niceeeeeeeeeeeeee persistence rat
- AsyncRat
  AsyncRAT is designed to remotely monitor and control other computers written in C#.
  rat asyncrat
- Remcos
  Remcos is a closed-source remote control and surveillance software.
  rat remcos
- Blocklisted process makes network request
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Drops startup file
- Loads dropped DLL
- Registers COM server for autorun
  persistence
- Suspicious use of SetThreadContext
behavioral3 behavioral4