asyncrat

General

Target

tokengenv2.exe
Size

5.5MB
Sample

240809-x958bszdkd
MD5

8a4b9a507b1354684eea9497b5be7726
SHA1

b5a2f6ab75eeb57e1180be7c9df4df8985ed9462
SHA256

337ee11eb36a403a120a88bfd48081c43c09bcac526744b23e9be52eab9179cf
SHA512

2c339991f94445c33f9139bbcfdaf2a294027af07702c054e95a4082d953b66130c97b37629e9d91b4b3cef03413569c8b307cb4380cba22ab27660bc76fd22e
SSDEEP

98304:8I9OWKAm9BkB2DzdtWtWBcQVlTYWhWcThW1WeRMxGr6fUw+5IW+B:f9JKBkgfdtkQcC1hWcThWcVrW+B

Score

10^/10

Malware Config

Extracted

Family

asyncrat

Version

0.5.7B

Botnet

Default

C2

127.0.0.1:6606

127.0.0.1:7707

127.0.0.1:8808

103.141.69.160:6606

103.141.69.160:7707

103.141.69.160:8808

Mutex

AsyncMutex_6SI8OkPnk

Attributes

delay
3
install
false
install_file
RuntimeBroker.exe
install_folder
%AppData%

aes.plain

Targets

- Target
  
  tokengenv2.exe
- Size
  
  5.5MB
- MD5
  
  8a4b9a507b1354684eea9497b5be7726
- SHA1
  
  b5a2f6ab75eeb57e1180be7c9df4df8985ed9462
- SHA256
  
  337ee11eb36a403a120a88bfd48081c43c09bcac526744b23e9be52eab9179cf
- SHA512
  
  2c339991f94445c33f9139bbcfdaf2a294027af07702c054e95a4082d953b66130c97b37629e9d91b4b3cef03413569c8b307cb4380cba22ab27660bc76fd22e
- SSDEEP
  
  98304:8I9OWKAm9BkB2DzdtWtWBcQVlTYWhWcThW1WeRMxGr6fUw+5IW+B:f9JKBkgfdtkQcC1hWcThWcVrW+B
Score

10^/10

asyncrat default defense_evasion discovery evasion rat spyware stealer trojan upx
- AsyncRat
  AsyncRAT is designed to remotely monitor and control other computers written in C#.
  rat asyncrat
- Modifies Windows Defender Real-time Protection settings
  evasion trojan
- Modifies security service
  evasion
- Async RAT payload
  rat
- Detected Nirsoft tools
  Free utilities often used by attackers which can steal passwords, product keys, etc.
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
  evasion
- NirSoft WebBrowserPassView
  Password recovery tool for various web browsers
- Checks BIOS information in registry
  BIOS information is often read in order to detect sandboxing environments.
- Drops startup file
- Executes dropped EXE
- Identifies Wine through registry keys
  Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.
  evasion
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
- Legitimate hosting services abused for malware hosting/C2
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
- Modifies Security services
  Modifies the startup behavior of a security service.
  defense_evasion
behavioral1