asyncrat | 16930620b3b9166e0ffbd98f5d5b580c9919fd6ccdcc74fb996f53577f508267

max time kernel
791s
max time network
901s
platform
windows11-21h2_x64
resource
win11-20241007-uk
resource tags

arch:x64arch:x86image:win11-20241007-uklocale:uk-uaos:windows11-21h2-x64systemwindows
submitted
27-11-2024 19:53

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

4363463463464363463463463.exe
Size

10KB
MD5

2a94f3960c58c6e70826495f76d00b85
SHA1

e2a1a5641295f5ebf01a37ac1c170ac0814bb71a
SHA256

2fcad226b17131da4274e1b9f8f31359bdd325c9568665f08fd1f6c5d06a23ce
SHA512

fbf55b55fcfb12eb8c029562956229208b9e8e2591859d6336c28a590c92a4d0f7033a77c46ef6ebe07ddfca353aba1e84b51907cd774beab148ee901c92d62f
SSDEEP

192:xlwayyHOXGc20L7BIW12n/ePSjiTlzkGu8stYcFwVc03KY:xlwwHe/20PKn/cLTlHuptYcFwVc03K

Malware Config

Extracted

Family

lumma

https://reinforcenh.shop/api

https://stogeneratmns.shop/api

https://fragnantbui.shop/api

https://drawzhotdog.shop/api

https://vozmeatillu.shop/api

https://offensivedzvju.shop/api

https://ghostreedmnu.shop/api

https://gutterydhowi.shop/api

https://moutheventushz.shop/api

https://respectabosiz.shop/api

https://bakedstusteeb.shop/api

https://conceszustyb.shop/api

https://nightybinybz.shop/api

https://standartedby.shop/api

https://mutterissuen.shop/api

https://worddosofrm.shop/api

https://berrylinyj.cyou

Extracted

Family

phorphiex

http://185.215.113.66/

http://91.202.233.141/

Wallets

0xCa90599132C4D88907Bd8E046540284aa468a035

TRuGGXNDM1cavQ1AqMQHG8yfxP4QWVSMN6

qph44jx8r9k5xeq5cuf958krv3ewrnp5vc6hhdjd3r

XryzFMFVpDUvU7famUGf214EXD3xNUSmQf

rsXCXBf9SagxV8JfC12d8Bybk84oPdMNN9

AULzfBuUAPfCGAXoG5Vq14aP9s6fx3AH4Z

LdgchXq1sKbAaAJ1EXAPSRBzLb8jnTZstT

MP8GEm8QpYgQYaMo8oM5NQhRBgDGiLZW5Q

4AtjkCVKbtEC3UEN77SQHuH9i1XkzNiRi5VCbA2XGsJh46nJSXfGQn4GjLuupCqmC57Lo7LvKmFUyRfhtJSvKvuw3h9ReKK

15TssKwtjMtwy4vDLcLsQUZUD2B9f7eDjw85sBNVC5LRPPnC

1BzmrjmKPKSR2hH5BeJySfiVA676E8DYaK

ltc1qt0n3f0t7vz9k0mvcswk477shrxwjhf9sj5ykrp

3PMiLynrGVZ8oEqvoqC4hXD67B1WoALR4pc

3ESHude8zUHksQg1h6hHmzY79BS36L91Yn

DLUzwvyxN1RrwjByUPPzVMdfxNRPGVRMMA

t1J6GCPCiHW1eRdjJgDDu6b1vSVmL5U7Twh

stars125f3mw4xd9htpsq4zj5w5ezm5gags37yxxh6mj

bnb1msyt0djx4ecspfxg5en0ye465kg3kmv9utzml2

bc1ppypcmu3684n648gyj62gjp2rw0xy7w3vwfamatlg29ajp4z52desafa0sr

bc1qc9edl4hzl9jyt8twdad3zjeh2df2znq96tdezd

Attributes

mutex
753f85d83d
user_agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36

Extracted

Family

asyncrat

Version

0.5.8

Botnet

Default

stuff-data.gl.at.ply.gg:54296

Mutex

u81wDUVoFHib

Attributes

delay
3
install
false
install_folder
%AppData%

aes.plain

Extracted

Family

asyncrat

Version

0.5.7B

Botnet

Default

3.70.228.168:555

Mutex

AsyncMutex_6SI8OkPnk

Attributes

delay
3
install
false
install_folder
%AppData%

aes.plain

Extracted

Family

xworm

147.185.221.22:46682

127.0.0.1:46682

memory-julia.gl.at.ply.gg:3595

Attributes

Install_directory
%Temp%
install_file
svchost.exe

Extracted

Family

vidar

Version

11.4

Botnet

119b6e2263f46f13917bbde173112248

https://t.me/asg7rd

https://steamcommunity.com/profiles/76561199794498376

Attributes

user_agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/17.6 Safari/605.1.15 Ddg/17.6

Extracted

Family

xworm

Version

5.0

0.tcp.eu.ngrok.io:10358

6.tcp.eu.ngrok.io:10358

4.tcp.eu.ngrok.io:10358

Mutex

QvDYkhYsc5WBgCcl

Attributes

Install_directory
%AppData%
install_file
XClient.exe

aes.plain

Extracted

Family

redline

Botnet

LiveTraffic

95.179.250.45:26212

Extracted

Family

quasar

Version

1.1.0.0

Botnet

User

erbaevbann3.ddns.net:4444

Mutex

xTSR_MUTEX_tDOmSpZY0vhNMbdmkR

Attributes

encryption_key
Uz3u2uI4Ld2N91oq93Eb
install_name
systemware.exe
log_directory
logs
reconnect_delay
3000
startup_key
System Ware
subdirectory
system

Extracted

Family

redline

185.215.113.67:21405

Extracted

Family

quasar

Version

1.4.0.0

Botnet

Office

82.117.243.110:5173

Mutex

yfsS9ida0wX8mgpdJC

Attributes

encryption_key
KDNBgA8jiBeGX1rj1dDt
install_name
csrss.exe
log_directory
Logs
reconnect_delay
3000
startup_key
NET framework
subdirectory
SubDir

Signatures

AsyncRat
AsyncRAT is designed to remotely monitor and control other computers written in C#.
rat asyncrat
Asyncrat family
asyncrat

Detect Vidar Stealer 4 IoCs

stealer

Processes:

resource	yara_rule
behavioral1/memory/2356-1180-0x0000000001400000-0x0000000001700000-memory.dmp	family_vidar_v7
behavioral1/memory/2356-1181-0x0000000001400000-0x0000000001700000-memory.dmp	family_vidar_v7
behavioral1/memory/2356-1205-0x0000000001400000-0x0000000001700000-memory.dmp	family_vidar_v7
behavioral1/memory/2356-1206-0x0000000001400000-0x0000000001700000-memory.dmp	family_vidar_v7

Detect Xworm Payload 8 IoCs

Processes:

resource	yara_rule
behavioral1/files/0x0002000000025cd2-502.dat	family_xworm
behavioral1/memory/776-509-0x0000000000860000-0x000000000087A000-memory.dmp	family_xworm
behavioral1/files/0x001a00000002ad9f-3459.dat	family_xworm
behavioral1/memory/3360-3464-0x0000000000420000-0x000000000043A000-memory.dmp	family_xworm
behavioral1/files/0x001900000002adad-4397.dat	family_xworm
behavioral1/memory/1876-4402-0x0000000000120000-0x0000000000130000-memory.dmp	family_xworm
behavioral1/files/0x000b000000000695-10356.dat	family_xworm
behavioral1/files/0x000d00000002b85b-11261.dat	family_xworm

Detects ZharkBot payload 1 IoCs

ZharkBot is a botnet written C++.

Processes:

resource	yara_rule
behavioral1/files/0x001b00000002ae25-10029.dat	zharkcore

Lumma Stealer, LummaC
Lumma or LummaC is an infostealer written in C++ first seen in August 2022.
stealer lumma
Lumma family
lumma
Phorphiex family
phorphiex

Phorphiex payload 1 IoCs

Processes:

resource	yara_rule
behavioral1/files/0x0004000000025be9-156.dat	family_phorphiex

Phorphiex, Phorpiex
Phorphiex or Phorpiex Malware family which infects systems to distribute other malicious payloads such as ransomware, stealers and cryptominers.
worm trojan loader phorphiex

Quasar RAT 10 IoCs

Quasar is an open source Remote Access Tool.

trojan spyware quasar

Processes:

4363463463464363463463463.exe

description	flow	ioc	Process
Key opened		\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	4363463463464363463463463.exe
	6	ipinfo.io