asyncrat

General

Target

DiscordDEV.exe
Size

64KB
Sample

240404-z7adzsaf6v
MD5

90973346b6819d640dc9301288e156b1
SHA1

49f02abe11fe5cafe492c0b6ed30b04714b538a0
SHA256

a3bb72f860b25f8e709a88172d0bc50c41831080c3ae603d522a16867a1beb63
SHA512

d7b23fe2b40269d06811f243b3d25d1f0c6a03d321b2bac84968ed6bdd7bda4de24c452c50d4a8cd44017faae436159693d015d278103ac26184fb7e001dbd48
SSDEEP

1536:ZQj1EfBnKfoELH1xb720FUbYh9Gd1FuNEpqKmY7:ZK2uzFUbY4MPz

Score

10^/10

Malware Config

Extracted

Family

asyncrat

Botnet

Default

C2

127.0.0.1:8989

127.0.0.1:11692

0.tcp.eu.ngrok.io:8989

0.tcp.eu.ngrok.io:11692

Mutex

TsOΔXשrQΑ迪ΘΖתd9VTvM迪

Attributes

delay
3
install
true
install_file
ProgramDataInstaller.exe
install_folder
%Temp%

aes.plain

Targets

- Target
  
  DiscordDEV.exe
- Size
  
  64KB
- MD5
  
  90973346b6819d640dc9301288e156b1
- SHA1
  
  49f02abe11fe5cafe492c0b6ed30b04714b538a0
- SHA256
  
  a3bb72f860b25f8e709a88172d0bc50c41831080c3ae603d522a16867a1beb63
- SHA512
  
  d7b23fe2b40269d06811f243b3d25d1f0c6a03d321b2bac84968ed6bdd7bda4de24c452c50d4a8cd44017faae436159693d015d278103ac26184fb7e001dbd48
- SSDEEP
  
  1536:ZQj1EfBnKfoELH1xb720FUbYh9Gd1FuNEpqKmY7:ZK2uzFUbY4MPz
Score

10^/10

asyncrat default rat stealerium stormkitty collection ransomware spyware stealer
- AsyncRat
  AsyncRAT is designed to remotely monitor and control other computers written in C#.
  rat asyncrat
- Stealerium
  An open source info stealer written in C# first seen in May 2022.
  stealer stealerium
- StormKitty
  StormKitty is an open source info stealer written in C#.
  stealer stormkitty
- StormKitty payload
- Async RAT payload
  rat
- Renames multiple (3106) files with added filename extension
  This suggests ransomware activity of encrypting all the files on the system.
  ransomware
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Accesses Microsoft Outlook profiles
  collection
- Legitimate hosting services abused for malware hosting/C2
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
- Looks up geolocation information via web service
  Uses a legitimate geolocation service to find the infected system's geolocation info.
- Sets desktop wallpaper using registry
  ransomware
behavioral1 behavioral2