asyncrat

General

Target

Dork_Searcher_v3.zip
Size

2.2MB
Sample

250103-dxkajszqek
MD5

f2094ab0ffe06124e836beba8b1af312
SHA1

86f98c7cac38bef4071078f4cf44772ed3472e6f
SHA256

e26627bf50ef412d0a549da70f297c978ed8ec4d6bd5883897fd02aeae500ae9
SHA512

3f30543f5e562a0a581c6fee76bbe24b3e7220e34e37e11689bae02dc32e9d78541a2c1eef7662a25d712ea00a37a645aeddc03bf79c791c82f852ec96286c0e
SSDEEP

49152:bfHw+J4rZgwiAEk0lei79jMxz/6POxVpZ0HRbah9kfTPQTO+/4+Sg:8+J4d0fk0ki79IxLU4X0HRbHPQTAw

Score

10^/10

Malware Config

Extracted

Family

xred

C2

xred.mooo.com

Attributes

email
[email protected]
payload_url
http://freedns.afraid.org/api/?action=getdyndns&sha=a30fa98efc092684e8d1c5cff797bcc613562978

https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download

https://www.dropbox.com/s/n1w4p8gc6jzo0sg/SUpdate.ini?dl=1

http://xred.site50.net/syn/SUpdate.ini

https://docs.google.com/uc?id=0BxsMXGfPIZfSVzUyaHFYVkQxeFk&export=download

https://www.dropbox.com/s/zhp1b06imehwylq/Synaptics.rar?dl=1

http://xred.site50.net/syn/Synaptics.rar

https://docs.google.com/uc?id=0BxsMXGfPIZfSTmlVYkxhSDg5TzQ&export=download

https://www.dropbox.com/s/fzj752whr3ontsm/SSLLibrary.dll?dl=1

http://xred.site50.net/syn/SSLLibrary.dll

Extracted

Family

asyncrat

Botnet

Default

C2

127.0.0.1:6606

127.0.0.1:7707

127.0.0.1:8808

Mutex

AsyncMutex_6SI8OkPnk

Attributes

delay
3
install
false
install_folder
%AppData%

aes.plain

Targets

- Target
  
  Dork_Searcher_v3/Dork Searcher v3 tool.exe
- Size
  
  928KB
- MD5
  
  1a4c4d1cc1267908302913a678102cff
- SHA1
  
  1dd2d37f67a461afe414b8339d68ce98964cc962
- SHA256
  
  045dc9a19e22a98167614ddccf210219576fe440d320144fd51a73fb38360e7f
- SHA512
  
  c3c9433b3cfe8df34b6d56b1252dad8c185430a12ae744cb71a8493a420d135a77f14682b71827eeb43c8f4c7ad3a0d96a69c94b5ba4144c0881f99df176ae3e
- SSDEEP
  
  12288:sMSApJVYG5lDLyjsb0eOzkv4R7QnvUUilQ35+6G75V9VoKcXrCf/Q6qj:snsJ39LyjbJkQFMhmC+6GD90CfDW
Score

10^/10

asyncrat stormkitty xred default backdoor discovery persistence phishing privilege_escalation rat spyware stealer
- AsyncRat
  AsyncRAT is designed to remotely monitor and control other computers written in C#.
  rat asyncrat
- Asyncrat family
  asyncrat
- StormKitty
  StormKitty is an open source info stealer written in C#.
  stealer stormkitty
- StormKitty payload
- Stormkitty family
  stormkitty
- Xred
  Xred is backdoor written in Delphi.
  backdoor xred
- Xred family
  xred
- Async RAT payload
  rat
- A potential corporate email address has been identified in the URL: WorldWindProResultsDate2025010332345AMSystemWindows10Pro64BitUsernameAdminCompNameHGNBWBGWLanguageenUSAntivirusNotinstalledHardwareCPU12thGenIntelRCoreTMi512400GPUMicrosoftBasicDisplayAdapterRAM16154MBHWIDUnknownPowerNoSystemBattery1Screen1280x720NetworkGatewayIP10.127.0.1InternalIP10.127.1.63ExternalIP181.215.176.83BSSID16bf38fd2615DomainsinfoBankLogsNodataCryptoLogsNodataFreakyLogsNodataLogsBookmarks5SoftwareDeviceWindowsproductkeyDesktopscreenshotFileGrabberDatabasefiles6TelegramChannel@XSplinter
  phishing
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Adds Run key to start application
  persistence
- Drops desktop.ini file(s)
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
- Looks up geolocation information via web service
  Uses a legitimate geolocation service to find the infected system's geolocation info.
behavioral1
- Target
  
  Dork_Searcher_v3/System.Data.SQLite.dll
- Size
  
  309KB
- MD5
  
  7a2a3c08b71b0bcdc4abc24d04c2adef
- SHA1
  
  7479cdfac87c208cc88c95e9a352034f6afd628d
- SHA256
  
  bd52ab1bdd0f3668fffade808d43dc5be0924d178a71f06192e663268fa83fd9
- SHA512
  
  f26c01361b71550212aa13f45f1f9b93c1d2cfedcc695fdad7790daa816466dfb66acb2f0a4866d77e2fe19315ffb652b7aae9a3fc45d146c9fc9da26976154f
- SSDEEP
  
  6144:8Q1jh89RtD90xRFNFaFeFOFwcGF6cmFWc0FWc8cIcKcUFJFpcNcHc7cbchFFc5cS:8ejh89yFNFaFeFOFwcGF6cmFWc0FWc8j
Score

1^/10
behavioral2
- Target
  
  Dork_Searcher_v3/x64/SQLite.Interop.dll
- Size
  
  1.4MB
- MD5
  
  7ba0f41c37f7835094d4bd1aef92eda4
- SHA1
  
  81af2d7ffec9d99fc0f54ae765fe8ec8f32aacf3
- SHA256
  
  9db8e965935be690988bf290ac11b01ce5508adb9945b4bd74f033a178f40f06
- SHA512
  
  9ed64c83222007e8ace264c930606e861ee05c53f2d0b5a6c252c116a2426dcce7929ced0c0ffc4d260b3d440619e31e8bd3e0a77a8b5f7fe7ce0e81e4cd621e
- SSDEEP
  
  24576:oxvuMV4Y/rHl2MY3BoBBWz/8BkCXCU2zSmM:Y/roMSoB+EmCXCUe
Score

1^/10
behavioral3
- Target
  
  Dork_Searcher_v3/x86/SQLite.Interop.dll
- Size
  
  1.1MB
- MD5
  
  544ef841728185f7a4766e5f12b290f2
- SHA1
  
  744c3032c5d6b2bce2883a9f937ac1f4d941da00
- SHA256
  
  2fe073d8b5b42f18b4009340538148b12aed7e4903c6a62822f7cedfb558fa8b
- SHA512
  
  65201c85e7fb7adefcd57692fd68dd5625c88a58d59c8344c29d8f28255d173bfe8846e794bb9a30c8f9e0599f38dbf482fe5235431e1c4e86b86a78bc1203fc
- SSDEEP
  
  24576:7VvYDXUSpZtNn0kzPp/nAsHi7fjkBl5u:7IXUkW6o
Score

3^/10

discovery
behavioral4
- Target
  
  Dork_Searcher_v3/xNet.dll
- Size
  
  99KB
- MD5
  
  5c4d74259ec27bd64271f1f7eecb44a7
- SHA1
  
  e9f2ce8035cd13c5a4cd3898d0fa45639ba0c4cb
- SHA256
  
  e2232490a88f3761d0767c495d46b88ce605e3a070f5912f00c4640b1d5e006c
- SHA512
  
  04be014bd82eb2292022792d0717f1d02bc96e1063539ed2fec3fc5ab82ebd9aa1d14d41900323e6baef7c9dce8471021d4e06ab61522151a9cab1a30326a1d4
- SSDEEP
  
  3072:Vq14cHjHF56dXxdqnV+xnEdnRmNmZMY3wiwe0YyBq:VqOcDWqnV+xnEdO
Score

1^/10
behavioral5