asyncrat

General

Target
2025-11-08_cf2e637960ac7af52d8d81e1a7c45b4e_elex_wannacry
Size 8.4MB
Sample251109-a7c3faxrgk
SHA256 350b22de8ed92a3debcf721536c6bb3a44b44470cddfba598409c160d3a3f226
MD5 cf2e637960ac7af52d8d81e1a7c45b4e
SHA1 ae9eb1f91e4c035d1c3e91aa74a2c95955ae40fe
SHA512 11426a1f6612be3590775b70b701a9051498cb3595527de4c4120a69366194a6bfcf2059c80238483dd3bf136213f2d772ba250ad8683bb5105b8f0560adf560
SSDEEP 98304:+p1g+buSpytLxSo0D783RBni+saYWopvj/WnVi8yko5REa8lkp9G+ICdMGxc1/OV:+p58TSr83RBnvsBWol0Nyj2GS/Oxfl1P
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

Malware Config

Extracted

Family

hijackloader

Attributes

directory
%APPDATA%\api
inject_dll
%windir%\SysWOW64\rasapi32.dll

xor.hex

Extracted

Family

asyncrat

Version

| CRACKED BY https://t.me/xworm_v2

Botnet

Default

C2

envioansyr.dynuddns.net:6969

Mutex

AsyncMutex_6SI8OkPnk

Attributes

delay
3
install
false
install_folder
%AppData%

aes.plain

Targets

- Target
  2025-11-08_cf2e637960ac7af52d8d81e1a7c45b4e_elex_wannacry
- Size 8.4MB
- SHA256 350b22de8ed92a3debcf721536c6bb3a44b44470cddfba598409c160d3a3f226
- MD5 cf2e637960ac7af52d8d81e1a7c45b4e
- SHA1 ae9eb1f91e4c035d1c3e91aa74a2c95955ae40fe
- SHA512 11426a1f6612be3590775b70b701a9051498cb3595527de4c4120a69366194a6bfcf2059c80238483dd3bf136213f2d772ba250ad8683bb5105b8f0560adf560
- SSDEEP 98304:+p1g+buSpytLxSo0D783RBni+saYWopvj/WnVi8yko5REa8lkp9G+ICdMGxc1/OV:+p58TSr83RBnvsBWol0Nyj2GS/Oxfl1P
- MD5 SHA1 SHA512 SSDEEP
Score

10^/10

default discovery asyncrat hijackloader loader rat
- AsyncRat
  AsyncRAT is designed to remotely monitor and control other computers written in C#.
  rat asyncrat
- Asyncrat family
  asyncrat
- Detects HijackLoader (aka IDAT Loader)
- HijackLoader
  HijackLoader is a multistage loader first seen in 2023.
  loader hijackloader
- Hijackloader family
  hijackloader
- Async RAT payload
  rat
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

2

T1082

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Extracted

Extracted

Targets

Asyncrat family

Detects HijackLoader (aka IDAT Loader)

HijackLoader

Hijackloader family

Async RAT payload

Checks computer location settings

Executes dropped EXE

Loads dropped DLL

Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2