asyncrat

General

Target

Abella_Danger_Photo
Size

39KB
Sample

241120-serdgaylfw
MD5

ddb95e2792a54f6df10d771fdc5d64dd
SHA1

b74421240a6090e6a8ecab75196c8fc427a78b88
SHA256

8feb7fd93ca9901efc73de47de02e763037072130d5c1b121e91e41dcebd16f4
SHA512

dfb9877897ab0bb987cdf40a47ef6d4229c31b20709b0018599fe1ffdaefefcca39f564dfbb723749a47a7a5b3d33ac8ccc26ed4b106971330a97c0dc74c14eb
SSDEEP

768:+/S/S/F/AkV+5VPJX/69uCi5BuRSqFBeWpg:+/S/S/F/AkV+5VPJv69uCi5BuRSqFBe9

Score

10^/10

Malware Config

Extracted

Language

ps1

Deobfuscated

URLs

ps1.dropper

https://1017.filemail.com/api/file/get?filekey=2Aa_bWo9Reu45t7BU1kVgsd9pT9pgSSlvStGrnTICfFhmTKj3LC6SQtIcOc_T35w&pk_vid=fd4f614bb209c62c1730945176a0904f

exe.dropper

https://1017.filemail.com/api/file/get?filekey=2Aa_bWo9Reu45t7BU1kVgsd9pT9pgSSlvStGrnTICfFhmTKj3LC6SQtIcOc_T35w&pk_vid=fd4f614bb209c62c1730945176a0904f

Extracted

Family

asyncrat

Version

1.0.7

Botnet

1

C2

148.113.165.11:3236

Mutex

asassassas

Attributes

delay
1
install
false
install_folder
%AppData%

aes.plain

Targets

- Target
  
  Abella_Danger_Photo
- Size
  
  39KB
- MD5
  
  ddb95e2792a54f6df10d771fdc5d64dd
- SHA1
  
  b74421240a6090e6a8ecab75196c8fc427a78b88
- SHA256
  
  8feb7fd93ca9901efc73de47de02e763037072130d5c1b121e91e41dcebd16f4
- SHA512
  
  dfb9877897ab0bb987cdf40a47ef6d4229c31b20709b0018599fe1ffdaefefcca39f564dfbb723749a47a7a5b3d33ac8ccc26ed4b106971330a97c0dc74c14eb
- SSDEEP
  
  768:+/S/S/F/AkV+5VPJX/69uCi5BuRSqFBeWpg:+/S/S/F/AkV+5VPJv69uCi5BuRSqFBe9
Score

10^/10

execution asyncrat 1 discovery rat
- AsyncRat
  AsyncRAT is designed to remotely monitor and control other computers written in C#.
  rat asyncrat
- Asyncrat family
  asyncrat
- Blocklisted process makes network request
- Command and Scripting Interpreter: PowerShell
  Run Powershell and hide display window.
  execution
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Suspicious use of SetThreadContext
behavioral1 behavioral2