asyncrat

General

Target

caf7afab30b06cd0f7e04e58d74eae92
Size

248KB
Sample

240315-yfcvcshd9x
MD5

caf7afab30b06cd0f7e04e58d74eae92
SHA1

d2f660783a60f769a145e6950382ec14aa058604
SHA256

ebbddbc283ca755442e0651f50ca542a01b896fb05fa62ad18270f791ecec6bb
SHA512

deecd35d3f36130e4e6faec6b8f8964399f1e9f4ede11096bf6d0e7ce8036dbe375f8be93cd5a864c1d7e03de2535ec2885413a497a4f0b7775a53035fdaee8b
SSDEEP

3072:Hveff3/WI3G4qvOLOdbR7JCCNxNlZjemWa6hg5GuGUgMdZafD4UA1b:HEJG9mGR8CN3ymWa65uRb4cxb

Score

10^/10

Malware Config

Extracted

Family

gcleaner

C2

194.145.227.161

Extracted

Family

xworm

Version

5.0

C2

127.0.0.1:7000

Mutex

LK1tcQzVjdOfCJrx

Attributes

Install_directory
%AppData%
install_file
sv_gost120938.exe

aes.plain

Targets

- Target
  
  caf7afab30b06cd0f7e04e58d74eae92
- Size
  
  248KB
- MD5
  
  caf7afab30b06cd0f7e04e58d74eae92
- SHA1
  
  d2f660783a60f769a145e6950382ec14aa058604
- SHA256
  
  ebbddbc283ca755442e0651f50ca542a01b896fb05fa62ad18270f791ecec6bb
- SHA512
  
  deecd35d3f36130e4e6faec6b8f8964399f1e9f4ede11096bf6d0e7ce8036dbe375f8be93cd5a864c1d7e03de2535ec2885413a497a4f0b7775a53035fdaee8b
- SSDEEP
  
  3072:Hveff3/WI3G4qvOLOdbR7JCCNxNlZjemWa6hg5GuGUgMdZafD4UA1b:HEJG9mGR8CN3ymWa65uRb4cxb
Score

10^/10

asyncrat gcleaner onlylogger xworm zgrat loader persistence rat trojan
- AsyncRat
  AsyncRAT is designed to remotely monitor and control other computers written in C#.
  rat asyncrat
- Detect Xworm Payload
- Detect ZGRat V1
- GCleaner
  GCleaner is a Pay-Per-Install malware loader first discovered in early 2019.
  loader gcleaner
- OnlyLogger
  A tiny loader that uses IPLogger to get its payload.
  loader onlylogger
- Xworm
  Xworm is a remote access trojan written in C#.
  trojan rat xworm
- ZGRat
  ZGRat is remote access trojan written in C#.
  rat zgrat
- Async RAT payload
  rat
- OnlyLogger payload
- .NET Reactor proctector
  Detects an executable protected by an unregistered version of Eziriz's .NET Reactor.
- Drops startup file
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
  persistence
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
behavioral1