asyncrat

General

Target
AsyncRAT 3LOSH Mod.7z
Size 24.6MB
Sample251029-pwffraypaw
SHA256 5e7d3a1bd3c5d7ef64712823747b750983a6a67b7ded712700c9852c84fe2257
MD5 dacb5bc11693ffcec0f5160bf6518eb5
SHA1 9ed70511a537b7b622b15f62fdcfe121b2fee71a
SHA512 64fe99c48c76629964c3527aa180f6def895040a015f62d48a7a1ddd50e5bd3033df1f138e35d9aa47301311ec23152a936e9daf676c8b616df47f5bad5a1a81
SSDEEP 786432:emdhVFohpr2A6LKXQcXv+9kTNF5iws7oplp52LMnVu:ndwr2A6LKVbvs7oplxu
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

Malware Config

Extracted

Family

asyncrat

Version

| Edit by Vinom Rat

Botnet

Default

Mutex

AsyncMutex_6SI8OkPnk

Attributes

delay
3
install
true
install_file
r.exe
install_folder
%AppData%
local_host
127.0.0.1

aes.plain

Targets

- Target
  AsyncRAT/AsyncRAT.exe
- Size 7.1MB
- SHA256 c51a0017762a31bda284c235eb470b46810c177ee785624bef75cff9bbc3f062
- MD5 d974876918c358db7b356403a21a674e
- SHA1 c0056644d00aeb9f3e2267d803fe7a8b87ebfe65
- SHA512 449660d5bc3478c3a69594421b4adf404354841762f2a677c9f018d5c76dbc5bd23cbbaa9d31371531ac829f999d362ce7773812085b783805e71932b38d2a9b
- SSDEEP 98304:tPwbPmDVa3VxobFqjEGu/N5xXhAqin1p0T+Srp46xJJ33Je2mCrPkwy0PyK8:tY7aI7jEG2N5htin+f3HJDNsc6K
- MD5 SHA1 SHA512 SSDEEP
Score

10^/10

default collection defense_evasion discovery execution asyncrat xenarmor password persistence rat recovery spyware stealer upx
- AsyncRat
  AsyncRAT is designed to remotely monitor and control other computers written in C#.
  rat asyncrat
- Asyncrat family
  asyncrat
- XenArmor Suite
  XenArmor is as suite of password recovery tools for various application.
  recovery password xenarmor
- Xenarmor family
  xenarmor
- Async RAT payload
  rat
- Detected Nirsoft tools
  Free utilities often used by attackers which can steal passwords, product keys, etc.
- ACProtect 1.3x - 1.4x DLL software
  Detects file using ACProtect software.
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Loads dropped DLL
- Reads WinSCP keys stored on the system
  Tries to access WinSCP stored sessions.
  spyware stealer
- Reads data files stored by FTP clients
  Tries to access configuration files associated with programs like FileZilla.
  spyware stealer
- Reads local data of messenger clients
  Infostealers often target stored data of messaging applications, which can include saved credentials and account information.
  spyware stealer
- Reads user/profile data of local email clients
  Email clients store some user data on disk where infostealers will often target it.
  spyware stealer
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Accesses Microsoft Outlook accounts
  collection
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
behavioral1