asyncrat

Resubmissions

25-01-2025 23:53

250125-3w9aqawpap 10

25-01-2025 23:45

25-01-2025 01:01

13-01-2025 17:50

13-01-2025 17:32

Sharing

Copy URL

Twitter E-mail

General

Target

New Text Document mod.exe.zip
Size

392KB
Sample

250125-bc9zcsypbn
MD5

209c2bed74ce311f3de2c3040f5cbd8b
SHA1

676dbe2bbf178ca27210c8a2e37aa9652f4e17d5
SHA256

672ad2d52af206cc63cebe2c801181d3b406aae5891cc57bdaafd5eea3d61fe6
SHA512

44b5207ce1a79c220ed014b7803ba4f3b89b0aa81f2232e152da9e5c8004c164a281d8806843a10590e3c55b902ef5e3f359bc117b80b11d052fe60324709324
SSDEEP

6144:PiyQGVN3t3bmwUUoI7a+OjFjjGFEduVVZ4vELL2VzCGb49pRYCEheDmDUKUQWCCJ:P/HfRx7aNFXuhTL2I70SmpXCqry

Malware Config

Extracted

Family

xred

xred.mooo.com

Attributes

email
[email protected]
payload_url
http://freedns.afraid.org/api/?action=getdyndns&sha=a30fa98efc092684e8d1c5cff797bcc613562978

https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download

https://www.dropbox.com/s/n1w4p8gc6jzo0sg/SUpdate.ini?dl=1

http://xred.site50.net/syn/SUpdate.ini

https://docs.google.com/uc?id=0BxsMXGfPIZfSVzUyaHFYVkQxeFk&export=download

https://www.dropbox.com/s/zhp1b06imehwylq/Synaptics.rar?dl=1

http://xred.site50.net/syn/Synaptics.rar

https://docs.google.com/uc?id=0BxsMXGfPIZfSTmlVYkxhSDg5TzQ&export=download

https://www.dropbox.com/s/fzj752whr3ontsm/SSLLibrary.dll?dl=1

http://xred.site50.net/syn/SSLLibrary.dll

Extracted

Family

asyncrat

Version

0.5.7B

Botnet

System Program

tuna91.duckdns.org:1604

Mutex

AsyncMutex_6SI8OkPnk

Attributes

delay
3
install
true
install_file
system.exe
install_folder
%AppData%

aes.plain

Extracted

Family

remcos

Botnet

RemoteHost

else-directors.gl.at.ply.gg:56448

185.158.251.159:2404

stopeet.camdvr.org:2404

amalar.camdvr.org:2404

prosir.casacam.net:2404

Attributes

audio_folder
MicRecords
audio_record_time
5
connect_delay
0
connect_interval
1
copy_file
$77-Bitdefender.exe
copy_folder
Bitdefender
delete_file
true
hide_file
true
hide_keylog_file
false
install_flag
true
keylog_crypt
false
keylog_file
logs.dat
keylog_flag
false
keylog_folder
remcos
mouse_option
false
mutex
Rmc-Z3DS2J
screenshot_crypt
false
screenshot_flag
false
screenshot_folder
Screenshots
screenshot_path
%AppData%
screenshot_time
10
startup_value
VisualStudioServer
take_screenshot_option
false
take_screenshot_time
5

Extracted

Family

quasar

Version

1.4.1

Botnet

bot

wexos47815-61484.portmap.host:61484

Mutex

06e2bb33-968c-4ca7-97dc-f23fbd5c3092

Attributes

encryption_key
8924CB3C9515DA437A37F5AE598376261E5528FC
install_name
msinfo32.exe
log_directory
Update
reconnect_delay
3000
startup_key
Discordupdate
subdirectory
dll32

Extracted

Family

xworm

Version

3.1

172.86.108.55:7771

Attributes

Install_directory
%AppData%
install_file
USB.exe

Extracted

Family

xworm

Version

5.0

137.184.74.73:5000

Mutex

WlO6Om8yfxIARVE4

Attributes

install_file
USB.exe
pastebin_url
https://pastebin.com/raw/7G6zzQwJ

aes.plain

Extracted

Family

quasar

Version

1.4.1

Botnet

VM-KU

adidya354-21806.portmap.host:21806

Mutex

cf7c4d30-a326-47cc-a5f0-5a19aa014204

Attributes

encryption_key
E50BC33BC56B70B1A2963DE6EA1855A0E0D0FBCE
install_name
Windows Shell Interactive.exe
log_directory
Logs
reconnect_delay
3000
startup_key
Windows Shell Interactive

Extracted

Family

asyncrat

Version

A 13

Botnet

Default

163.172.125.253:333

Mutex

AsyncMutex_555223

Attributes

delay
3
install
false
install_folder
%AppData%

aes.plain

Extracted

Family

asyncrat

Version

Esco Private rat

Botnet

Default

93.123.109.39:4449

Mutex

bcrikqwuktplgvg

Attributes

delay
1
install
false
install_folder
%AppData%

aes.plain

Extracted

Family

quasar

Version

1.4.1

Botnet

Office04

192.168.1.79:4782

0.tcp.in.ngrok.io:14296

193.161.193.99:20466

Mutex

956eafb2-7482-407b-bff4-d2b57a1c3d75

Attributes

encryption_key
EFEBD005E03B8B8669985D9A167E2BEF9FFCA477
install_name
Client.exe
log_directory
Logs
reconnect_delay
3000
startup_key
Quasar Client Startup
subdirectory
SubDir

Extracted

Family

quasar

Version

1.3.0.0

Botnet

School

gamwtonxristo.ddns.net:1717

Mutex

QSR_MUTEX_M3Vba1npfJg3Ale25C

Attributes

encryption_key
VtojWKM7f1XyCVdB41wL
install_name
comctl32.exe
log_directory
Logs
reconnect_delay
3000
startup_key
Windows Defender Startup Scan
subdirectory
Windows Defender

Extracted

Family

stealerium

https://api.telegram.org/bot6926474815:AAFx9tLAnf5OAVQZp2teS3G2_6T1wCP67xM/sendMessage?chat_id=-4224073938

Extracted

Family

asyncrat

Version

0.5.8

Botnet

Default

2.tcp.eu.ngrok.io:19695

38.240.58.195:6606

Mutex

gonq3XlXWgiz

Attributes

delay
3
install
false
install_folder
%AppData%

aes.plain

Extracted

Family

redline

Botnet

Standoff

89.23.101.77:1912

Extracted

Family

quasar

Version

1.3.0.0

Botnet

Office04

20.107.53.25:25535

Mutex

QSR_MUTEX_zQ0poF2lHhCSZKSUZ3

Attributes

encryption_key
E2xbpJ93MnABcIqioTDL
install_name
Client.exe
log_directory
Logs
reconnect_delay
3000
startup_key
Quasar Client Startup
subdirectory
SubDir

Extracted

Family

redline

Botnet

first

212.56.41.77:1912

Extracted

Family

quasar

Version

1.3.0.0

Botnet

sigorta

217.195.197.170:1604

Mutex

QSR_MUTEX_9WjAcLINYji1uqfzRt

Attributes

encryption_key
B2vTTMiPGqHXv2xzSGYH
install_name
Client.exe
log_directory
Logs
reconnect_delay
3000
startup_key
Quasar Client Startup
subdirectory
SubDir

Targets

- Target
  
  New Text Document mod.exe.zip
- Size
  
  392KB
- MD5
  
  209c2bed74ce311f3de2c3040f5cbd8b
- SHA1
  
  676dbe2bbf178ca27210c8a2e37aa9652f4e17d5
- SHA256
  
  672ad2d52af206cc63cebe2c801181d3b406aae5891cc57bdaafd5eea3d61fe6
- SHA512
  
  44b5207ce1a79c220ed014b7803ba4f3b89b0aa81f2232e152da9e5c8004c164a281d8806843a10590e3c55b902ef5e3f359bc117b80b11d052fe60324709324
- SSDEEP
  
  6144:PiyQGVN3t3bmwUUoI7a+OjFjjGFEduVVZ4vELL2VzCGb49pRYCEheDmDUKUQWCCJ:P/HfRx7aNFXuhTL2I70SmpXCqry
Score

10^/10

asyncrat quasar redline remcos stealerium xred xworm bot default first office04 remotehost school sigorta standoff system program vm-ku backdoor defense_evasion discovery execution infostealer persistence phishing rat spyware stealer trojan
- AsyncRat
  AsyncRAT is designed to remotely monitor and control other computers written in C#.
  rat asyncrat
- Asyncrat family
  asyncrat
- Detect Xworm Payload
- Quasar RAT
  Quasar is an open source Remote Access Tool.
  trojan spyware quasar
- Quasar family
  quasar
- Quasar payload
- RedLine
  RedLine Stealer is a malware family written in C#, first appearing in early 2020.
  infostealer redline
- RedLine payload
- Redline family
  redline
- Remcos
  Remcos is a closed-source remote control and surveillance software.
  rat remcos
- Remcos family
  remcos
- Stealerium
  An open source info stealer written in C# first seen in May 2022.
  stealer stealerium
- Stealerium family
  stealerium
- UAC bypass
  defense_evasion trojan
- Xred
  Xred is backdoor written in Delphi.
  backdoor xred
- Xred family
  xred
- Xworm
  Xworm is a remote access trojan written in C#.
  trojan rat xworm
- Xworm family
  xworm
- Adds policy Run key to start application
  persistence
- Command and Scripting Interpreter: PowerShell
  Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
  execution
- Downloads MZ/PE file
- Modifies Windows Firewall
  defense_evasion
- A potential corporate email address has been identified in the URL: [email protected]
  phishing
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
  persistence
- Legitimate hosting services abused for malware hosting/C2
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
behavioral1
- Target
  
  New Text Document mod.exe
- Size
  
  761KB
- MD5
  
  c6040234ee8eaedbe618632818c3b1b3
- SHA1
  
  68115f8c3394c782aa6ba663ac78695d2b80bf75
- SHA256
  
  bb459869e5ef6d6dd6f0329080d7cb12542c4b37163ae2cd782620adcd7d55a0
- SHA512
  
  a3d8c8c6a990797a99887e0e07a01b1e2fe0a4e53df7294fed18a1e856d56a7762e0ab4a8e4689de411acb4fd29b8d7e247fbc696d855a9976a760d33ab60bcf
- SSDEEP
  
  12288:mMSApJVYG5lDLyjsb0eOzkv4R7QnvUUilQ35+6G75V9mWej:mnsJ39LyjbJkQFMhmC+6GD9I
Score

10^/10

asyncrat nanocore quasar remcos stealerium xred xworm bot default office04 remotehost school system program vm-ku backdoor defense_evasion discovery execution keylogger persistence privilege_escalation rat spyware stealer trojan
- AsyncRat
  AsyncRAT is designed to remotely monitor and control other computers written in C#.
  rat asyncrat
- Asyncrat family
  asyncrat
- Detect Xworm Payload
- NanoCore
  NanoCore is a remote access tool (RAT) with a variety of capabilities.
  keylogger trojan stealer spyware nanocore
- Nanocore family
  nanocore
- Quasar RAT
  Quasar is an open source Remote Access Tool.
  trojan spyware quasar
- Quasar family
  quasar
- Quasar payload
- Remcos
  Remcos is a closed-source remote control and surveillance software.
  rat remcos
- Remcos family
  remcos
- Stealerium
  An open source info stealer written in C# first seen in May 2022.
  stealer stealerium
- Stealerium family
  stealerium
- Suspicious use of NtCreateUserProcessOtherParentProcess
- UAC bypass
  defense_evasion trojan
- Xred
  Xred is backdoor written in Delphi.
  backdoor xred
- Xred family
  xred
- Xworm
  Xworm is a remote access trojan written in C#.
  trojan rat xworm
- Xworm family
  xworm
- Async RAT payload
  rat
- Adds policy Run key to start application
  persistence
- Command and Scripting Interpreter: PowerShell
  Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
  execution
- Disables Task Manager via registry modification
  defense_evasion
- Downloads MZ/PE file
- Modifies Windows Firewall
  defense_evasion
- Drops startup file
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
  persistence
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
- Checks whether UAC is enabled
  defense_evasion trojan
- Legitimate hosting services abused for malware hosting/C2
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
- Drops autorun.inf file
  Malware can abuse Windows Autorun to spread further via attached volumes.
- Drops file in System32 directory
- Suspicious use of SetThreadContext
behavioral2