asyncrat

General

Target

TronMiner-2024.rar
Size

1.9MB
Sample

240221-ypeqbafb58
MD5

4e42a985ca737716dd59d13b99c50283
SHA1

76aef7b9d0406250a42dc2f7ad636c2b2ea9884d
SHA256

f5d3a3fe964d364b810ed1d6cbad6ee89da1b0586e80f2794b55d102d8536168
SHA512

a4103f3e29ef78fb1f8eae7d6ea91f2cca0fd19657ac71ec9bb43cf2907b7c3424f7de03027a504c1dea95bf0613076b682fba618409df482e9bbe8e1c12b7bd
SSDEEP

49152:W6zFMF+R0oa6qRsPz4n5pPP6hb4zCcS3ayW77b:BFMFi0oabwz47n6paCcQ6X

Score

10^/10

Malware Config

Extracted

Family

darkcomet

Botnet

New-July-July4-02

C2

dgorijan20785.hopto.org:35800

Mutex

DC_MUTEX-JFYU2BC

Attributes

gencode
UkVkDi2EZxxn
install
false
offline_keylogger
true
password
hhhhhh
persistence
false

Extracted

Family

warzonerat

C2

dgorijan20785.hopto.org:5199

45.74.4.244:5199

Extracted

Family

darkcomet

Botnet

New-July-July4-0

C2

45.74.4.244:35800

Mutex

DC_MUTEX-RT27KF0

Attributes

gencode
cKUHbX2GsGhs
install
false
offline_keylogger
true
password
hhhhhh
persistence
false

Extracted

Family

asyncrat

Version

0.5.6A

C2

45.74.4.244:6606

45.74.4.244:7707

45.74.4.244:8808

Mutex

servtle284

Attributes

delay
5
install
true
install_file
wintskl.exe
install_folder
%AppData%

aes.plain

Targets

- Target
  
  TronMiner-2024/TronMiner-2024.exe
- Size
  
  2.0MB
- MD5
  
  15307910d7c9a3a1215e4e4e4f500895
- SHA1
  
  49a7df2a0ebfb6556c1e17cc8baf8cd5756eded9
- SHA256
  
  514caaa6fbcdf64af8cbb24487ba1f89d1219ac25988c51a34fc850f6bf0b8e5
- SHA512
  
  9b9f339a4c7bbf1b824e2efcad3c8fb84bd47b153d29f459a9e50624a83481a81441db0aaf9fb2eae0842aa5c3358e103bad28a7a5b45f152ebe28fccbeb4453
- SSDEEP
  
  49152:qoUM9eEZyfky3a7B9L787fYIdLVYZcl+:/UMHyR3sB9q7CKA
Score

10^/10

darkcomet warzonerat new-july-july4-02 infostealer persistence rat trojan upx asyncrat babylonrat new-july-july4-0
- AsyncRat
  AsyncRAT is designed to remotely monitor and control other computers written in C#.
  rat asyncrat
- Babylon RAT
  Babylon RAT is remote access trojan written in C++.
  trojan babylonrat
- Darkcomet
  DarkComet is a remote access trojan (RAT) developed by Jean-Pierre Lesueur.
  trojan rat darkcomet
- WarzoneRat, AveMaria
  WarzoneRat is a native RAT developed in C++ with multiple plugins sold as a MaaS.
  rat infostealer warzonerat
- Warzone RAT payload
  rat
- Drops file in Drivers directory
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Drops startup file
- Executes dropped EXE
- Loads dropped DLL
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
- Adds Run key to start application
  persistence
- Suspicious use of SetThreadContext
behavioral1 behavioral2