asyncrat

General

Target
Quantum-Private.zip
Size 18.9MB
Sample240328-c6dnpadc9s
SHA256 18994b1cd85550a5e702d7accd7daf7fa2d7208eb1526d35c58eca692c79f312
MD5 e010a0352bccb799ad3cc3f5a1d8b3e5
SHA1 d10369ad1e882ec6752cd7fd52e23a576e948591
SHA512 6555937e0b827ebce8fd072f0b247f36e7d8d678f2afe5a513d2c45e95a0b5cbd7dd3ca3c1c85adf704211e1aa1e0b9fde410a1e799de0c7a5ab107ac7d08369
SSDEEP 393216:3+FMfyYddY8pMlR5njm5SpwTevT1m91GsgsY9JVvTHrLq2Pk:3gMfTMlTnjm58vhm9ssSRvTHrLq2Pk
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

Malware Config

Extracted

Family

asyncrat

Version

Venom RAT + HVNC + Stealer + Grabber v6.0.3

Botnet

WinChromeBrowser

C2

127.0.0.1:4449
127.0.0.1:4444
136.0.3.250:4449
136.0.3.250:4444

Mutex

c^oRl6v#&MS*TI

Attributes

delay
120
install
false
install_file
QuantumLazer.exe
install_folder
%AppData%

aes.plain

Targets

- Target
  Quantum-Private/QuantumLoader.exe
- Size 18.5MB
- SHA256 69d4495345c95506405428ad52dd912680c9378f8471d75369b3551f562a6624
- MD5 858746dfe88a1584ff3e20a2b5f3674d
- SHA1 c8ae947f468dd0d15e7f9a4e459740cb16760efd
- SHA512 1dba7e7fb17c98dbf97910601754160341d183b573e197c453bbb59287f73de0125dc0743436477956c47aa732256d304b2afa46e9d0eff887301d272b37bf7d
- SSDEEP 393216:i76jW8RLSKD4Bx53TCzonobwNJhU/XuqoIKxJrFztRDs0:06jp4Bv3TCzoNLU/eqg7FztRDs0
- MD5 SHA1 SHA512 SSDEEP
Score

10^/10

asyncrat winchromebrowser evasion rat themida trojan
- AsyncRat
  AsyncRAT is designed to remotely monitor and control other computers written in C#.
  rat asyncrat
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
  evasion
- Checks BIOS information in registry
  BIOS information is often read in order to detect sandboxing environments.
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Themida packer
  Detects Themida, an advanced Windows software protection system.
  themida
- Checks whether UAC is enabled
  evasion trojan
- Suspicious use of NtSetInformationThreadHideFromDebugger
behavioral1
- Target
  Quantum-Private/QuantumRunningAgent.dll
- Size 924KB
- SHA256 efb80e7fc59775068ec3cbef99b0dd7f84916d3b22edf65a26b5363334f2ba5f
- MD5 b8f198a305864534a2eaa2b91cfb9a96
- SHA1 3abea6c16521d2336faff9dae5a8515a29fe3155
- SHA512 d33cfb73c4bc9f69d173dd945ecdb68f22786c06bb2e00ec8874b688ff6cdc285be5a77c6babdde103775fb250ed50f974211da9984ca87baff4980451abc971
- SSDEEP 24576:x0DTEOHdQWW9OVWXcK8YNOMKZQJpMZ2Zrn9:6DTTCW3yA9MWQjo6n
- MD5 SHA1 SHA512 SSDEEP
Score

1^/10
behavioral2