asyncrat

Target

クラック.zip
Size

13.4MB
Sample

240909-3hx1jaxfqb
MD5

6c5fc1a3ba386a83c87700f54d62a96f
SHA1

a05f08de3e4f218ad2567a2695d0ca500fb48ecf
SHA256

67c12eda1cc8358e06ef29eabf1542bf68db9da45df65c52d0ac03246bf75e03
SHA512

0a2573e40287c35c5a05c9b84fd5fd41bacc16c1bb565ee823ff6a42610c151f460a4be6d7009f0a70b648234aa998af27769ae667f4649c223c39c07449a098
SSDEEP

393216:T0Wxsts7B2+qq0a1n5Gy0vdymghya/2yswYpmTg:wGg1+0a1nYvvJghD/2yMM8

Malware Config

Extracted

Family

asyncrat

Botnet

Default

127.0.0.1:6606

127.0.0.1:7707

127.0.0.1:8808

https://api.telegram.org/bot7293375371:AAFwIvNWcuknS3y3mtsx4yNSSTkj8NCF_ko/sendMessage?chat_id=5795480469

Mutex

AsyncMutex_6SI8OkPnk

Attributes

delay
3
install
false
install_folder
%AppData%

aes.plain

Extracted

Family

njrat

Version

im523

Botnet

puked

147.185.221.20:47570

Mutex

20006afb0ec33f2e48c8c1f17d4d3382

Attributes

reg_key
20006afb0ec33f2e48c8c1f17d4d3382
splitter
|'|'|

Extracted

Family

remcos

Botnet

AUGUST CRYPTER TOOLZ GRACE STUB

teamfavour222.ddns.net :6767

odogwuvisual123.duckdns.org:6767

Attributes

audio_folder
MicRecords
audio_record_time
5
connect_delay
0
connect_interval
1
copy_file
remcos.exe
copy_folder
Remcos
delete_file
false
hide_file
false
hide_keylog_file
false
install_flag
false
keylog_crypt
false
keylog_file
logs.dat
keylog_flag
false
keylog_folder
remcos
mouse_option
false
mutex
-YFLE4M
screenshot_crypt
false
screenshot_flag
false
screenshot_folder
Screenshots
screenshot_path
%AppData%
screenshot_time
10
take_screenshot_option
false
take_screenshot_time
5

Extracted

Path

C:\$Recycle.Bin\S-1-5-21-2412658365-3084825385-3340777666-1000\WYCTFAL-DECRYPT.txt

Ransom Note

---= GANDCRAB V5.0.3 =--- ***********************UNDER NO CIRCUMSTANCES DO NOT DELETE THIS FILE, UNTIL ALL YOUR DATA IS RECOVERED*********************** *****FAILING TO DO SO, WILL RESULT IN YOUR SYSTEM CORRUPTION, IF THERE WILL BE DECRYPTION ERRORS***** Attention! All your files, documents, photos, databases and other important files are encrypted and have the extension: .WYCTFAL The only method of recovering files is to purchase an unique private key. Only we can give you this key and only we can recover your files. The server with your key is in a closed network TOR. You can get there by the following ways: ---------------------------------------------------------------------------------------- | 0. Download Tor browser - https://www.torproject.org/ | 1. Install Tor browser | 2. Open Tor Browser | 3. Open link in TOR browser: http://gandcrabmfe6mnef.onion/eadf193d5f1ce137 | 4. Follow the instructions on this page ---------------------------------------------------------------------------------------- On our page you will see instructions on payment and get the opportunity to decrypt 1 file for free. ATTENTION! IN ORDER TO PREVENT DATA DAMAGE: * DO NOT MODIFY ENCRYPTED FILES * DO NOT CHANGE DATA BELOW ---BEGIN GANDCRAB KEY--- lAQAAPENxrsB2dueqyCPhIwSW7xUiUDDm9xG6u8kti0/uoT/wDxTyR63mYVw9RT2xZnGD7Rsuj3+tO7one9U2S08av1VS9U25wGizBHeXn6pcuTTI6TqNMqQhY+au0fErbvUTM7zHnCCp3LkAVdjo+PhUSsINo4/YgRRKIMjAuB1lxOhCF9uHAUYwcEb/+OUAWIsk1bPuQ95kid/u30gtMBkGMmN3Znkvtt/75V3weUhFy3bBqgcHQm9Ny55raiFBlkOk0ZhpRlTAEQEA6U47dgLhqddkzLZBkMREmBp19MzhDFE+OG+Cz/GJK9WyT2mPILpO8rR353YrBeiYEHwVVc6kH3Lwt2vNoP4W6xyLOK/WtCdWzuifVF78Gjs1Pr6pfkHpHHGssH5gSpsKJyvuzjcGsKLHuHLOSpLQHeQJrJHGSclOi78P7nfQQMTnd0X4eEFCDbKndeSB/s3re2teY+kZw0t0gCZjo0ylwHEQRhsqIyNvjRGH9kyMOHLPqbjMSpXaH6T3SPmBGdAfSmdryatuL9Jom29K/KmnMu1UAyGJTUgvxctThXM9BKrk1JlkWn8/pDtbyZ8AUCV4gm41XtvOudoOuWzRRVv1HFvPyTnMLVBT39gayByGDq609xpiQPFy5bWbxDp2U2VwP2uSndrRPv6ztFnPYsCeDDuQOQ3oQpxa4ODLemWb/YA4ARUX534N2GVzvM2cUuBU+zzZgn+etoe5WndjA/tMBF6C7N1zAsDHwMcBxx0kej+i02QzL+mqEBzIVjETKZBq/MlBUEdaeAfnClNbU7cF00LHoIMlh9I8I4kxUQcWip/AvV/HQj2k2zK37evt5+/GMb8rseFQxt1hTyfhuUs417et5KFik3Zcd67i3Yxgrnr/z5q0VgPIdlzl0b8AbAaaIdd94fpOejyVJY4a003CRUHcGWrh/n/1eU9oC8IDEuvXHGBBNKv8aw4Mp8c/nns5+pZNGVrStkX1GJp5gHNH0IahEJQI9zVZpWnv+N58I7U9txI63Vxo9KDs8kQdurnEjNhtKIbfUQEw7vdeV4fY3jDcxQp27p/IHTgGdPGI++TccGEUHEKtuU68zo/fbH/zl/wYis2tczI9JVNvMafr6HmJurKXaVNsQEABTH8FY40JErLOiSfTE2A/RAAGXbFBitUbSf1jvab17cABpk4m6ypaEj3KSoZCFA2D6+XnP3Ukf5BBTtopErLhssRcEE8ZDcgvelZsxlmAarOwNj48Y7k+QDHfBy286EYO/FpPFM+tvOpPEY6JEah2AzhDxdVT1XIU04ZU4Aoj7PE3w1ChKL+2YCx2GtWeidYI3GAwJyZ0uioOO8wG3h4pV7r+KKCayyrEL6O+rWvkLT/OMu0S6htlKixiUoWreebT9OHiSXkIBjruF3EqFzicahOioiaNjJhTRy0V5/c3TbsSohHHGgYAbiHIs57WSm3S6a213+99dyNYNKzhmEgNkPSMX3yZKITUPfZZQIyl6covPhVDCIeA/eCPVHzfvCeh1hXI1VkDMBs1MgTZX8bwTrTmu4Ea8JiowGeMwRDFiS0S2TXL3Y/Vgct744X7u7SykjYoy3Lu3fwcA/kl0gnhTFztqlVxBhyYyHSzcpEnO/iQUgldQbgtc4BddZBnKcgFQwuEgRhdP2M07H982Fsh3dfW9rXaqPEov+vil3ESXT38lwZBmTsZ6un9QksB4bWOyvgfuqK+AcJiawyGh+uyoQ5V5cfIegMV6WNE3eWLsunGRjvliZfyW5X+EtuoTwEa+hU7UB1ClEybvindu8TVZecHuCt+1Bxm7hIXtFX32deTUM4JOAwCMmOPueoVRB2Tj6Ydn++R1wOcl+ElnIYxJQsGdbuYcrDqijujGYxA4edt9a3aQY7mWBXQhNIkO+foe+hccWsyZqQe5FLiPyHzHxQWFXm6dj3AvxauOZSCyZi3AAhkFQHIp+s5aF4UIOxHJhpMFJEz7OR9uXujFkbwBDiKvKzQcJgI1xxINaC35bQFHP4g2h8E5pYXv4HeDMreU2V4dlFIHQdo2c6enbOeYvc2s7YT3+5E0woRJe06UXPKZCvWpm9SrGyqva3+99fe7xtW3OZ7nncc7UY0446EddeE6ruqIEmY6vncCZ34N5MyfepAG9lHMBStLsY4m6qgVPjG+hlrfhnzqlBM8xV05MaIbpcXnKMk+Y7RZCeub7xFQjCyFPyvRIC7PPha3dnCc6GbuekNGZRiHNbbphFF+w= ---END GANDCRAB KEY--- ---BEGIN PC DATA--- wfKD6iudumBkmpL8IRr4U4exEVaoOXLtwDwmOrT1y1YWvOiWMx5GYaRdvZZfToFRunYP7ntWvLfSTHKHhh5qBJzzs9MC7736UkGSDDniUJJG8/LFF//kmGmoAZAGLo2j5/wd2UrxMJK+iqKhTkS3ArgAxrZOOOiXrbnhbWMkLHQnbYuWlMClYZxYU6SDxpopRo5r292AV1KIZBZV4APBuUHcKSIr2MWMI0O1MKIP2IpKLE2TS5wNmoQoAHZIP7k/TfrG1tVzlDb3jcZAB3gql9dnWN0lCD4xdg7bDNQrvH1xSi3FCw+6kfktKtizqdynr7r154JiurEmkUXBteL1/zI2R+snGtJYb1rXBiLt+xHXEYob9CcT4tq4PKb3Y5NyPYz32XaispQRTRkqF1PXJPcJ15EHwNAoARPLnK8+Au5ZALyfhGEwg6hrKQ3vxBFKwg70Zi7pDhFO3vDLMuao1wQZMnQeRlGKYDmn1lvgAn90mSDf7SyGQSZnn7Ivlsuw7HIKVYbpfzf2fBccdMBnP2lNhH9XQ3DC2qZAEuDtLkioBZ9MNJGhHpcOfb/LRc8P54k7V/HuibORzJL9NXYEh8sz/ewORahtHP+ZbmbW4eJPXp1eNtQ19EJhJFLe2qhgw2mJLRMzwAtbfjn5E2ENiW4EkrJfTw== ---END PC DATA---

URLs

http://gandcrabmfe6mnef.onion/eadf193d5f1ce137

Extracted

Family

xloader

Version

2.6

Campaign

eido

Decoy

revellbb.com

tempranillowine.net

viralstrategies.info

blacktxu.com

flfththirdbank.com

vaoex.com

theselfdirectedinvestor.com

vinadelmar.travel

othersidejimmythemonkey.com

jaguar-landrovercenter-graz.com

supremeosterreich.com

chatsubs.com

free99.design

serviciosmvs.com

bongmecams.xyz

malikwoodson.com

onlinegamebox.club

694624.com

yeezyzapatos.club

istanbul-hairtransplant.com

Extracted

Family

njrat

Version

0.7d

Botnet

HacKed

192.168.1.42:5552

Mutex

bf7b1fe7a7644171a9985ea45221c25c

Attributes

reg_key
bf7b1fe7a7644171a9985ea45221c25c
splitter
|'|'|

Extracted

Family

njrat

Version

0.7d

Botnet

чучундра

hakim32.ddns.net:2000

safety-bronze.gl.at.ply.gg:4444

Mutex

27b92504703b09d3ee2dae0873e8e3f3

Attributes

reg_key
27b92504703b09d3ee2dae0873e8e3f3
splitter
|'|'|

Extracted

Family

njrat

Version

0.7d

Botnet

kosomk 555

dovelabobzgnan.ddns.net:5552

Mutex

a8c0d4cf5cfc2cc1149b5e071c2ab5df

Attributes

reg_key
a8c0d4cf5cfc2cc1149b5e071c2ab5df
splitter
|'|'|

Extracted

Path

F:\$RECYCLE.BIN\S-1-5-21-3761892313-3378554128-2287991803-1000\DZFHSJN-DECRYPT.txt

Ransom Note

---= GANDCRAB V5.0.3 =--- ***********************UNDER NO CIRCUMSTANCES DO NOT DELETE THIS FILE, UNTIL ALL YOUR DATA IS RECOVERED*********************** *****FAILING TO DO SO, WILL RESULT IN YOUR SYSTEM CORRUPTION, IF THERE WILL BE DECRYPTION ERRORS***** Attention! All your files, documents, photos, databases and other important files are encrypted and have the extension: .DZFHSJN The only method of recovering files is to purchase an unique private key. Only we can give you this key and only we can recover your files. The server with your key is in a closed network TOR. You can get there by the following ways: ---------------------------------------------------------------------------------------- | 0. Download Tor browser - https://www.torproject.org/ | 1. Install Tor browser | 2. Open Tor Browser | 3. Open link in TOR browser: http://gandcrabmfe6mnef.onion/9f2ec8eb2c89000b | 4. Follow the instructions on this page ---------------------------------------------------------------------------------------- On our page you will see instructions on payment and get the opportunity to decrypt 1 file for free. ATTENTION! IN ORDER TO PREVENT DATA DAMAGE: * DO NOT MODIFY ENCRYPTED FILES * DO NOT CHANGE DATA BELOW ---BEGIN GANDCRAB KEY--- lAQAACJymMlg9OZkgQslG7TEqgLSCZEJe5Bx34acaqr6hD36bgTF4Pnw/LjWpEfuPnxBpQ25dhZPkbxlS6ntukBFSfYUK0mlOZlQseuJlCpmwqIPlSOVSzNo2h3FGSswmstfSDYlReGIvNFO/Lo3LFRKspUqgPXXh13TJxqAX2wPDXj1mdsLilVraUSeGyWSDLEqOgPQ0pf3uXdu5oV1JSq9vjr3a01/+KCAxCqnEVJPN35OTw99XLsEcA6V4OUj4CH6bZSsoAINIEbewZqRMhhxHKb5Sg/ab/1W2fMT2qnnT1wJ/APRRlnA5YszuM7DLcMYcPE9S1vD9RktXyU877l9LirZp2Q1KEqFwYiZjuZMHHzbSoFcRgxDlixDiFZnv5AG6srMpy8AFNsNHCtJbPFsUhm3zJx7boohZH1r/TiSMAf650g13BjXBTa6/LpQPa0YSxj5rCw0gzBSBCo3wX/UNqgljROhkaDzDn/Q3Gf7c8ZmANn5NqN6N1emz8fCf7oo8vv7b8gKFX8SaKm7wVJMpgOdrPwVJymBwvcUSZVx1oQdUtZZL+dAU+VCQeDEG0P6khRZIlEzlfaSDpD9bWdif0/R1Ax97zp7tZ/4X3Q3dp2GAZo+zm0/a5OVkQI/1gnwwUmipOUP8yXFf9yk/qUiRv4+UW0tVQQmNAs9jKt4O2RqpV5veyoGdGYNEBuWh4qaaYYh8b9x2Bn/fm/j7HAG+7EE7xx8fNN6Pqc19OYLTB3QHeG+3Lc0rM9sz8nm5yM/PJfmfCCSilCArj3tCMpDruEqa0RBrsoSa5A0Qdc0399+s/CvExYUroxMojZZGQjIgKGTLPprwClyFHt+6yA+6agabiJ8BDmuXJUuQwrS9/GeQijFfRjvJk9tHxIHZBVjsCeu/ShqDnqXSbYvmrOYNdy5du85mH1dJw7pX09jiPYPaMTOeVd84umMJ7QC15ysWcpAmZnPlQUKjdiIt636H1SLwtlrEGx4mzGlXhmlracM+L+xvKs2tt2LrzyPq6KJCyA8pcgLoMODqZKdTB+YGFgdmGpRwh5/PXqV1zDeUHA16/5oRaaVGXe1Gfs8YE822uRs2M9MnX47Pc4h0HKzxFuJItRpmV21IjlhHjinRRs6km9rrxYRUwgPpipFtmaD8snp8KPmFlNvl73tmPgl+5Zgz85StzsVJgNgzNrms8euScaktoZPy8FxnKQZP3aGJI3h3NnEukZTgcD0ajPLd89dNOGlqQFJuExw4bbbdIEAnvQxuUZba/gpGjgxIW0wjUw/Zx4Pr7KgJW2KEmGtSB7DgcMof33dfyp0MOe6cEqAhOt4YmROidZGly5JIT2g3Ykn/teQlmLNlaKjJk8KXiigcySxI45D8ilSzV9sYIsoLiwBbQbsfkGafg9KcW0/dVkzfhwNmZf7FIyCCnMYs8G+e9wUHCaXSXrhPIPE1LMVuq0K3Ugd62PvIX/bdUU9PzaxcuCJzdSqCcMNJ5a8+m7IZmaC08OLEH7scntfgNaBe5LTP536qzr98C1oQYD/Ta1VJwPGIbF/1P4K8haomUjoMSGOnuj1vGPF5ub7EzVfXvARUFf7R8iXef90KZMa7U0VzIDWOhr8u8Aow+1nTP/hfkBBfmGXxsHyHbBZP2gguzMxj+F9XMfVqsGiFhKMgbvMAFjrKQ/RjQQYR8tGX8KMV9CnprABrRGauoS6mCp9yX3aNk2j8K+yabSAZt6ZZ4qd43K0sSBfjzDmAfhchR7+sinRuE6NMZ/bm2sZwB9ItRmBsaZXzv3AkQeg5WOvLJ5HnsEAYmlxML9yqyz517i6gphbX2/StFb7mLzNd0jNcQZN5QhzODa530ibi9pKo8xeBTwFp82Y1KnOpbFjj28wGV5N25yw3WayFsy+Oo5MG1ygMIETRNq9U4GhnVkbNcwLtm0Z3PmuenG5ZoOJnshFfYzvgd4HT6EiWpUAJ808G6I27GmYjztPzR/lJnvaaOLO8tz0XIgESReCbWwDHBMrUl3YbwdYfTJiHqNNe4fgPwOTNquO4ReQTMEh2NY9oOMP8ALBfGN0VG2RG4IJTR/kNbHf3fFxE/LUGc8NqZv+589I8kJeKGhopMiXpJhM9wOlkyCF4f2REZRDyKSsbC8YmCD5FIsDGuTfwihpzfmtOiXVT0kgKkCvGd14Xc2Ty9ZImyv2yuD3Kf5186Z163rwwaTvG35kMsNaNXk/vuU8DiqPp9COuVKsQJhtSqYhZfSQloA= ---END GANDCRAB KEY--- ---BEGIN PC DATA--- wfKD6iudumBkmpL8IRr4U4exEVaoOXLtwDwmOrT1y1YWvOiWMx5GYaRdvZZWTpZRrnYN7m9Wp7ffTHeHhh5qBJzzs9MC7736UkGSDDniUJJG8/LFF//kmGmoAZAGLo2j5/wd2UrxMJK+iqKhTkS3ArgAxrZOOOiXrbnhbWMkLHQnbYuWlMClYZxYU6SDxpopRo5r292AV1KIZBZV4APBuUHcKSIr2MWMI0O1MKIP2IpKLE2TS5wNmoQoAHZIP7k/TfrG1tVzlDb3jcZAB3gql9dnWN0lCD4xdg7bDNQrvH1xSi3FCw+6kfktKtizqdynr7r154JiurEmkUXB6eLy/2Q2ROt1GtNYOVrRBiXt/hHeEdAboScS4tm4aab3Y5NyPYz32XaispQRTRkqF1PXJPcJ15EHwNAoARPLnK8+Au5ZALyfhGEwg6hrKQ3vxBFKwg70Zi7pDhFJ3vHLM+at1wcZN3QQRlGKYDmn1lvgAn90mSDf7SyGQSZnn7Ivlsuw7HIKVYbpfzf2fBccdMBnP2lNhH9XQ3DC2qZAEuDtLkioBZ9MNJGhHpcOfb/LRc8P54k7V/HuibORzJL9NXYEh8sz/ewORahtHP+ZbmbW4eJPXp1eNtQ19EJhJFLe2qhgw2mJLRMzwAtbfjn5E2ENiW4EkrJfTw== ---END PC DATA---

URLs

http://gandcrabmfe6mnef.onion/9f2ec8eb2c89000b

Targets

- Target
  
  クラック.zip
- Size
  
  13.4MB
- MD5
  
  6c5fc1a3ba386a83c87700f54d62a96f
- SHA1
  
  a05f08de3e4f218ad2567a2695d0ca500fb48ecf
- SHA256
  
  67c12eda1cc8358e06ef29eabf1542bf68db9da45df65c52d0ac03246bf75e03
- SHA512
  
  0a2573e40287c35c5a05c9b84fd5fd41bacc16c1bb565ee823ff6a42610c151f460a4be6d7009f0a70b648234aa998af27769ae667f4649c223c39c07449a098
- SSDEEP
  
  393216:T0Wxsts7B2+qq0a1n5Gy0vdymghya/2yswYpmTg:wGg1+0a1nYvvJghD/2yMM8
Score

10^/10

asyncrat dcrat njrat remcos stormkitty xloader august crypter toolz grace stub default hacked puked eido defense_evasion discovery evasion execution impact infostealer loader ransomware rat stealer trojan upx vmprotect kosomk 555 чучундра
- AsyncRat
  AsyncRAT is designed to remotely monitor and control other computers written in C#.
  rat asyncrat
- DcRat
  DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.
  rat infostealer dcrat
- Process spawned unexpected child process
  This typically indicates the parent process was compromised via an exploit or macro.
- Remcos
  Remcos is a closed-source remote control and surveillance software.
  rat remcos
- StormKitty
  StormKitty is an open source info stealer written in C#.
  stealer stormkitty
- StormKitty payload
- Xloader
  Xloader is a rebranded version of Formbook malware.
  loader xloader
- njRAT/Bladabindi
  Widely used RAT written in .NET.
  trojan njrat
- Async RAT payload
  rat
- DCRat payload
  Detects payload of DCRat, commonly dropped by NSIS installers.
  rat
- Deletes shadow copies
  Ransomware often targets backup files to inhibit system recovery.
  ransomware defense_evasion impact execution
- Xloader payload
  rat
- Command and Scripting Interpreter: PowerShell
  Using powershell.exe command.
  execution
- Modifies Windows Firewall
  evasion
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
- Uses the VBS compiler for execution
- VMProtect packed file
  Detects executables packed with VMProtect commercial packer.
  vmprotect
- Legitimate hosting services abused for malware hosting/C2
- System Binary Proxy Execution: Verclsid
  Adversaries may abuse Verclsid to proxy execution of malicious code.
  defense_evasion
behavioral1 behavioral2