asyncrat

General

Target

PNSBt.js
Size

103KB
Sample

241120-yb8q8swpbq
MD5

82bf71f9d463c60e2304cbf9f9cac022
SHA1

d54cce9d9a238310b00d154c9f35033e62ca1d81
SHA256

3f354bdb3557ffb64892e788c439adc0da9f7fd4f39b143a1cc2d8f7059b4488
SHA512

19bf4493c19a438fbd21266f012f21b22a2cf0448db22c41d9994afaa200a04a621968737953c12408f7d31e9c8c0bbd253e900823364210090e98a841b5004c
SSDEEP

3072:MHXp+q62Nhxdd5pdq61HXp+q62Nhxdd5pdqsVd0HXp+q62Nhxdd5pdq61HXp+q61:k3/13jc3/13+

Score

10^/10

asyncrat *** 19 nov ***discovery execution rat

Malware Config

Extracted

Language

ps1

Deobfuscated

URLs

ps1.dropper

https://1017.filemail.com/api/file/get?filekey=2Aa_bWo9Reu45t7BU1kVgsd9pT9pgSSlvStGrnTICfFhmTKj3LC6SQtIcOc_T35w&pk_vid=fd4f614bb209c62c1730945176a0904f

exe.dropper

https://1017.filemail.com/api/file/get?filekey=2Aa_bWo9Reu45t7BU1kVgsd9pT9pgSSlvStGrnTICfFhmTKj3LC6SQtIcOc_T35w&pk_vid=fd4f614bb209c62c1730945176a0904f

Extracted

Family

asyncrat

Version

| CRACKED BY https://t.me/xworm_v2

Botnet

*** 19 NOV ***

C2

19nov2024.duckdns.org:9003

Mutex

AsyncMutex_6SI8OkPnk

Attributes

delay
3
install
false
install_folder
%AppData%

aes.plain

Targets

- Target
  
  PNSBt.js
- Size
  
  103KB
- MD5
  
  82bf71f9d463c60e2304cbf9f9cac022
- SHA1
  
  d54cce9d9a238310b00d154c9f35033e62ca1d81
- SHA256
  
  3f354bdb3557ffb64892e788c439adc0da9f7fd4f39b143a1cc2d8f7059b4488
- SHA512
  
  19bf4493c19a438fbd21266f012f21b22a2cf0448db22c41d9994afaa200a04a621968737953c12408f7d31e9c8c0bbd253e900823364210090e98a841b5004c
- SSDEEP
  
  3072:MHXp+q62Nhxdd5pdq61HXp+q62Nhxdd5pdqsVd0HXp+q62Nhxdd5pdq61HXp+q61:k3/13jc3/13+
Score

10^/10

execution asyncrat *** 19 nov ***discovery rat
- AsyncRat
  AsyncRAT is designed to remotely monitor and control other computers written in C#.
  rat asyncrat
- Asyncrat family
  asyncrat
- Blocklisted process makes network request
- Command and Scripting Interpreter: PowerShell
  Run Powershell and hide display window.
  execution
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Suspicious use of SetThreadContext
behavioral1 behavioral2