asyncrat | 5695a75d96e56497ab5f7175d5c1da59a4565df668cb89db774eefbb5bfb6cf5

Submit
Reports

Overview

overview

Static

static

d7deda9897...8d.exe

windows7-x64

d7deda9897...8d.exe

windows10-2004-x64

d80d51404c...20.exe

windows7-x64

d80d51404c...20.exe

windows10-2004-x64

d8a40fff2e...76.exe

windows7-x64

d8a40fff2e...76.exe

windows10-2004-x64

d92b5b0796...45.exe

windows7-x64

d92b5b0796...45.exe

windows10-2004-x64

de558a924a...a1.exe

windows7-x64

de558a924a...a1.exe

windows10-2004-x64

e1051e77a0...c0.exe

windows7-x64

e1051e77a0...c0.exe

windows10-2004-x64

e1ae0e66e2...be.exe

windows7-x64

e1ae0e66e2...be.exe

windows10-2004-x64

e4d5b043f5...f1.exe

windows7-x64

e4d5b043f5...f1.exe

windows10-2004-x64

e4d72d8ddc...a8.exe

windows7-x64

e4d72d8ddc...a8.exe

windows10-2004-x64

e5370d47a3...e0.exe

windows7-x64

e5370d47a3...e0.exe

windows10-2004-x64

e57bff75d5...ad.exe

windows7-x64

e57bff75d5...ad.exe

windows10-2004-x64

e65128450f...ea.exe

windows7-x64

e65128450f...ea.exe

windows10-2004-x64

e800a3ce24...c8.exe

windows7-x64

e800a3ce24...c8.exe

windows10-2004-x64

e8412c4989...cb.exe

windows7-x64

e8412c4989...cb.exe

windows10-2004-x64

e91296156c...ff.exe

windows7-x64

e91296156c...ff.exe

windows10-2004-x64

ea6ec9be3a...54.exe

windows7-x64

ea6ec9be3a...54.exe

windows10-2004-x64

Resubmissions

05-09-2023 01:34

230905-by5lrsch46 10

Analysis

max time kernel
134s
max time network
154s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
24-05-2024 01:20

Sharing

Copy URL

Twitter E-mail

Static task

static1

29 signatures

Behavioral task

behavioral1

Sample

d7deda9897282437fa0da638c09ce0a66a147d6c0ff6e05e5694eff45072a48d.exe

Resource

win7-20240508-en

windows7-x64

3 signatures

150 seconds

Behavioral task

behavioral2

Sample

d7deda9897282437fa0da638c09ce0a66a147d6c0ff6e05e5694eff45072a48d.exe

Resource

win10v2004-20240426-en

windows10-2004-x64

4 signatures

150 seconds

Behavioral task

behavioral3

Sample

d80d51404cf247d308a927c553201bffc89b06d8ff1c2590e031f46476671c20.exe

Resource

win7-20240508-en

windows7-x64

7 signatures

150 seconds

Behavioral task

behavioral4

Sample

d80d51404cf247d308a927c553201bffc89b06d8ff1c2590e031f46476671c20.exe

Resource

win10v2004-20240508-en

windows10-2004-x64

7 signatures

150 seconds

Behavioral task

behavioral5

Sample

d8a40fff2ed2312089771a05fd488f25b3a0c4805354a765793e0c70d5412076.exe

Resource

win7-20240221-en

collection spyware stealer

windows7-x64

11 signatures

150 seconds

Behavioral task

behavioral6

Sample

d8a40fff2ed2312089771a05fd488f25b3a0c4805354a765793e0c70d5412076.exe

Resource

win10v2004-20240508-en

collection spyware stealer

windows10-2004-x64

11 signatures

150 seconds

Behavioral task

behavioral7

Sample

d92b5b079600e4b7db2b17374ce0f2e20e077a28f9275c5054b857de09377745.exe

Resource

win7-20231129-en

windows7-x64

3 signatures

150 seconds

Behavioral task

behavioral8

Sample

d92b5b079600e4b7db2b17374ce0f2e20e077a28f9275c5054b857de09377745.exe

Resource

win10v2004-20240426-en

windows10-2004-x64

4 signatures

150 seconds

Behavioral task

behavioral9

Sample

de558a924a89a755f2d660f864d164c81e62ddf7da400fe771c0febbe1858aa1.exe

Resource

win7-20240508-en

asyncrat vbs09 rat

windows7-x64

1 signatures

150 seconds

Behavioral task

behavioral10

Sample

de558a924a89a755f2d660f864d164c81e62ddf7da400fe771c0febbe1858aa1.exe

Resource

win10v2004-20240508-en

asyncrat vbs09 rat

windows10-2004-x64

1 signatures

150 seconds

Behavioral task

behavioral11

Sample

e1051e77a093d4fd5c81b43914bff83dce8662374f1c7e4b3a082ce2094870c0.exe

Resource

win7-20240215-en

windows7-x64

1 signatures

150 seconds

Behavioral task

behavioral12

Sample

e1051e77a093d4fd5c81b43914bff83dce8662374f1c7e4b3a082ce2094870c0.exe

Resource

win10v2004-20240426-en

windows10-2004-x64

1 signatures

150 seconds

Behavioral task

behavioral13

Sample

e1ae0e66e2ad4ee07faec69a41c3aaf6982e5a5c6fe9af7403310c43519227be.exe

Resource

win7-20240220-en

agenttesla collection execution keylogger persistence spyware stealer trojan

windows7-x64

14 signatures

150 seconds

Behavioral task

behavioral14

Sample

e1ae0e66e2ad4ee07faec69a41c3aaf6982e5a5c6fe9af7403310c43519227be.exe

Resource

win10v2004-20240508-en

agenttesla collection execution keylogger persistence spyware stealer trojan

windows10-2004-x64

15 signatures

150 seconds

Behavioral task

behavioral15

Sample

e4d5b043f5c9e0894a5f4a21c93cd7347a609a900da8f56f55a0dd84269e81f1.exe

Resource

win7-20240221-en

vmprotect

windows7-x64

2 signatures

150 seconds

Behavioral task

behavioral16

Sample

e4d5b043f5c9e0894a5f4a21c93cd7347a609a900da8f56f55a0dd84269e81f1.exe

Resource

win10v2004-20240508-en

vmprotect

windows10-2004-x64

2 signatures

150 seconds

Behavioral task

behavioral17

Sample

e4d72d8ddc51c3881aac8e689eeb381b4c97a87cf7dc973c97e5fe35feaa80a8.exe

Resource

win7-20240221-en

redline infostealer

windows7-x64

2 signatures

150 seconds

Behavioral task

behavioral18

Sample

e4d72d8ddc51c3881aac8e689eeb381b4c97a87cf7dc973c97e5fe35feaa80a8.exe

Resource

win10v2004-20240508-en

redline infostealer

windows10-2004-x64

3 signatures

150 seconds

Behavioral task

behavioral19

Sample

e5370d47a36c3b7af18e4c8e1adb4a08f18bf9ee424f821ccfd585dfb7c111e0.exe

Resource

win7-20240419-en

agenttesla collection execution keylogger persistence spyware stealer trojan

windows7-x64

12 signatures

150 seconds

Behavioral task

behavioral20

Sample

e5370d47a36c3b7af18e4c8e1adb4a08f18bf9ee424f821ccfd585dfb7c111e0.exe

Resource

win10v2004-20240508-en

agenttesla collection execution keylogger persistence spyware stealer trojan

windows10-2004-x64

13 signatures

150 seconds

Behavioral task

behavioral21

Sample

e57bff75d5dff87a5a965e50d9acdfb8237419c14a102b78493d893e11b1adad.exe

Resource

win7-20240215-en

windows7-x64

1 signatures

150 seconds

Behavioral task

behavioral22

Sample

e57bff75d5dff87a5a965e50d9acdfb8237419c14a102b78493d893e11b1adad.exe

Resource

win10v2004-20240426-en

windows10-2004-x64

1 signatures

150 seconds

Behavioral task

behavioral23

Sample

e65128450ff1d82705658fe9599d02d0f3b3500542c156eff284e64d80a24dea.exe

Resource

win7-20240220-en

agenttesla collection keylogger spyware stealer trojan

windows7-x64

14 signatures

150 seconds

Behavioral task

behavioral24

Sample

e65128450ff1d82705658fe9599d02d0f3b3500542c156eff284e64d80a24dea.exe

Resource

win10v2004-20240426-en

agenttesla collection keylogger spyware stealer trojan

windows10-2004-x64

14 signatures

150 seconds

Behavioral task

behavioral25

Sample

e800a3ce2466445ee0414d5eeb436cbc23c580fd8eae4c61e6f092bf3f2992c8.exe

Resource

win7-20240508-en

lokibot collection spyware stealer trojan

windows7-x64

12 signatures

150 seconds

Behavioral task

behavioral26

Sample

e800a3ce2466445ee0414d5eeb436cbc23c580fd8eae4c61e6f092bf3f2992c8.exe

Resource

win10v2004-20240508-en

windows10-2004-x64

7 signatures

150 seconds

Behavioral task

behavioral27

Sample

e8412c49890da839070b49b7eb8f364b408557fd35ab5fc593637e4e8e496dcb.exe

Resource

win7-20240508-en

windows7-x64

3 signatures

150 seconds

Behavioral task

behavioral28

Sample

e8412c49890da839070b49b7eb8f364b408557fd35ab5fc593637e4e8e496dcb.exe

Resource

win10v2004-20240426-en

formbook v93r rat spyware stealer trojan

windows10-2004-x64

5 signatures

150 seconds

Behavioral task

behavioral29

Sample

e91296156cd506f7a152db4e4beac1c56ce03676f16db637c97cd135038409ff.exe

Resource

win7-20240221-en

windows7-x64

3 signatures

150 seconds

Behavioral task

behavioral30

Sample

e91296156cd506f7a152db4e4beac1c56ce03676f16db637c97cd135038409ff.exe

Resource

win10v2004-20240426-en

windows10-2004-x64

4 signatures

150 seconds

Behavioral task

behavioral31

Sample

ea6ec9be3aea67056e4564a9b3ce8d6e92eda54db32e710043de98d7d65ffd54.exe

Resource

win7-20240221-en

windows7-x64

0 signatures

150 seconds

Behavioral task

behavioral32

Sample

ea6ec9be3aea67056e4564a9b3ce8d6e92eda54db32e710043de98d7d65ffd54.exe

Resource

win10v2004-20240426-en

windows10-2004-x64

0 signatures

150 seconds

Report Analysis Logs

General

Target

de558a924a89a755f2d660f864d164c81e62ddf7da400fe771c0febbe1858aa1.exe
Size

45KB
MD5

88ce1fc7c64ce41bccfc80e97db6bbe3
SHA1

a20d4b7e038256c1e29e549cb18261d483a840bd
SHA256

de558a924a89a755f2d660f864d164c81e62ddf7da400fe771c0febbe1858aa1
SHA512

82138002d26357f3b14e4c33b4ec0235507ca99fab6f2f4bf10ebe8ae3ee7c5afa6be92d3d5a914fd322265226e60e8debd54fcdfc02dcde330abe4d8bb7abe3
SSDEEP

768:Pu/6ZTgoiziWUUM9rmo2qrjO5QyJ4PiNjPISzjbwgX3iwL6ocrFO8BDZrx:Pu/6ZTgle2IO52iKS3b3XSw2oGOadrx

Score

10^/10

asyncrat vbs09 rat

Malware Config

Extracted

Family

asyncrat

Version

0.5.7B

Botnet

VBS09

4Mekey.myftp.biz:6606

4Mekey.myftp.biz:7707

4Mekey.myftp.biz:8808

Mutex

AsyncMutex_6SI8OkPnk

Attributes

delay
3
install
false
install_folder
%AppData%

aes.plain

Signatures

AsyncRat
AsyncRAT is designed to remotely monitor and control other computers written in C#.
rat asyncrat

Processes

C:\Users\Admin\AppData\Local\Temp\de558a924a89a755f2d660f864d164c81e62ddf7da400fe771c0febbe1858aa1.exe
"C:\Users\Admin\AppData\Local\Temp\de558a924a89a755f2d660f864d164c81e62ddf7da400fe771c0febbe1858aa1.exe"
1⤵
PID:1548

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1548-0-0x00000000744FE000-0x00000000744FF000-memory.dmp

Filesize
4KB

Download
memory/1548-1-0x00000000000F0000-0x0000000000102000-memory.dmp

Filesize
72KB

Download
memory/1548-2-0x00000000744F0000-0x0000000074BDE000-memory.dmp

Filesize
6.9MB

Download
memory/1548-3-0x00000000744F0000-0x0000000074BDE000-memory.dmp

Filesize
6.9MB

Download