asyncrat

General

Target

spooferexe.exe
Size

63KB
Sample

240627-qt4agawdmp
MD5

4f3d74ad18bafdc2aaa94ea2d2bf9423
SHA1

2ccd26c6760ca04d9ca8b3761b2e9b54485450bf
SHA256

8f9b5a425ca5c012a26fa47754f9f2f102a90430033623e310ca18f10e8bb502
SHA512

0025953e7b173bb038726cd1ca3147a9a412decd8cd9991f1414560b837c0b6a0faf97078e640e872d8e1de23a040437a1d6c4bd4ab0aa359ff7cfb81e6df647
SSDEEP

1536:7RRQPpJrZ5wvBy10w8qYUbDh9KTMNrugdpqKmY7:7AYJiYUbDuqhGz

Score

10^/10

Malware Config

Extracted

Family

asyncrat

Botnet

Default

C2

0.tcp.eu.ngrok.io:13147

Attributes

delay
1
install
true
install_file
spoofer.exe
install_folder
%Temp%

aes.plain

Targets

- Target
  
  spooferexe.exe
- Size
  
  63KB
- MD5
  
  4f3d74ad18bafdc2aaa94ea2d2bf9423
- SHA1
  
  2ccd26c6760ca04d9ca8b3761b2e9b54485450bf
- SHA256
  
  8f9b5a425ca5c012a26fa47754f9f2f102a90430033623e310ca18f10e8bb502
- SHA512
  
  0025953e7b173bb038726cd1ca3147a9a412decd8cd9991f1414560b837c0b6a0faf97078e640e872d8e1de23a040437a1d6c4bd4ab0aa359ff7cfb81e6df647
- SSDEEP
  
  1536:7RRQPpJrZ5wvBy10w8qYUbDh9KTMNrugdpqKmY7:7AYJiYUbDuqhGz
Score

10^/10

asyncrat stealerium default collection evasion persistence privilege_escalation ransomware rat spyware stealer trojan
- AsyncRat
  AsyncRAT is designed to remotely monitor and control other computers written in C#.
  rat asyncrat
- Modifies Windows Defender Real-time Protection settings
  evasion trojan
- Stealerium
  An open source info stealer written in C# first seen in May 2022.
  stealer stealerium
- Async RAT payload
  rat
- Renames multiple (3220) files with added filename extension
  This suggests ransomware activity of encrypting all the files on the system.
  ransomware
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Windows security modification
  evasion trojan
- Accesses Microsoft Outlook profiles
  collection
- Legitimate hosting services abused for malware hosting/C2
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
- Looks up geolocation information via web service
  Uses a legitimate geolocation service to find the infected system's geolocation info.
behavioral1