asyncrat

General

Target

qaz.exe
Size

48KB
Sample

240427-n8xecsag2w
MD5

676a07c74e4487abada569413214be3f
SHA1

82ff0ba18b54f37b3703ea15b3414d735bd50827
SHA256

01072fd48095c4819ac6f11317706a90b0e476b3028cb2b0a628834061e03514
SHA512

71da9be9e00c19b07ea123a69fa29cc3ce08938f0e82abce58eff3e7c783e1595f1945ea2638bc010860278175694e0dc73b9de356aae1ea2f5e6c8ee1104439
SSDEEP

768:a0GwCSArxzUa65wdbDi3TeRb/m9eMF4TLFWt9jCU1A6OOAhx0Xj78ZCn:iZ99R6A9O9fF2FY9jCU1A6OOAv0Egn

Score

10^/10

Malware Config

Extracted

Family

xworm

Version

5.0

C2

127.0.0.1:7000

91.92.252.220:7000

41.199.23.195:7000

saveclinetsforme68465454711991.publicvm.com:7000

Mutex

wgRrsTR2yhDOozrq

Attributes

Install_directory
%AppData%
install_file
explorer.exe
telegram
https://api.telegram.org/bot2128988424:AAEkYnwvOQA95riqRZwlqBxg4GV-odRNOyo/sendMessage?chat_id=966649672

aes.plain

Extracted

Family

redline

Botnet

cheat

C2

saveclinetsforme68465454711991.publicvm.com:1111

Extracted

Family

asyncrat

Version

| CRACKED BY https://t.me/xworm_v2

Botnet

Default

C2

127.0.0.1:6606

127.0.0.1:7707

127.0.0.1:8808

saveclinetsforme68465454711991.publicvm.com:6606

saveclinetsforme68465454711991.publicvm.com:7707

saveclinetsforme68465454711991.publicvm.com:8808

Mutex

AsyncMutex_6SI8OkPnk

Attributes

delay
3
install
true
install_file
mstc.exe
install_folder
%AppData%

aes.plain

Targets

- Target
  
  qaz.exe
- Size
  
  48KB
- MD5
  
  676a07c74e4487abada569413214be3f
- SHA1
  
  82ff0ba18b54f37b3703ea15b3414d735bd50827
- SHA256
  
  01072fd48095c4819ac6f11317706a90b0e476b3028cb2b0a628834061e03514
- SHA512
  
  71da9be9e00c19b07ea123a69fa29cc3ce08938f0e82abce58eff3e7c783e1595f1945ea2638bc010860278175694e0dc73b9de356aae1ea2f5e6c8ee1104439
- SSDEEP
  
  768:a0GwCSArxzUa65wdbDi3TeRb/m9eMF4TLFWt9jCU1A6OOAhx0Xj78ZCn:iZ99R6A9O9fF2FY9jCU1A6OOAv0Egn
Score

10^/10

asyncrat redline sectoprat xworm cheat default infostealer persistence rat trojan
- AsyncRat
  AsyncRAT is designed to remotely monitor and control other computers written in C#.
  rat asyncrat
- Detect Xworm Payload
- RedLine
  RedLine Stealer is a malware family written in C#, first appearing in early 2020.
  infostealer redline
- RedLine payload
- SectopRAT
  SectopRAT is a remote access trojan first seen in November 2019.
  trojan rat sectoprat
- SectopRAT payload
- Xworm
  Xworm is a remote access trojan written in C#.
  trojan rat xworm
- Async RAT payload
  rat
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Drops startup file
- Executes dropped EXE
- Adds Run key to start application
  persistence
behavioral1 behavioral2