asyncrat | 96878f369e1761087c53949975076b6a4e36423fdf67367efba9e6e62acb7a5e

General

Target
96878f369e1761087c53949975076b6a4e36423fdf67367efba9e6e62acb7a5e
Size 3.3MB
Sample260802-rd5n2avana
SHA256 96878f369e1761087c53949975076b6a4e36423fdf67367efba9e6e62acb7a5e
MD5 5295e4a041a1f45f10428309aac02f29
SHA1 b6ad61ac273df5bb1fd889e426a6364a98237eb8
SHA512 0c72fbf405dd3470566eab75dd3a1e9823e6be94217cc64bda4fe7775fc647f9c985ea3805f4675d8b0cb1efa263dd09268a699f85c1f292415a258736ea498c
SSDEEP 49152:sCwsbCANnKXferL7Vwe/Gg0P+Wh3zJKwnsHyjtk2MYC5GD2X:/ws2ANnKXOaeOgmh3lKwnsmtk2ah
TLSH
T1C4F57CB2B19144BAC3F80570DD96D7F25BAC776D2BF2093677EC9DCA3A242483960319
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Extracted

Family

xred

C2

xred.mooo.com

Attributes

email
[email protected]
payload_url
http://freedns.afraid.org/api/?action=getdyndns&sha=a30fa98efc092684e8d1c5cff797bcc613562978

https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download

https://www.dropbox.com/s/n1w4p8gc6jzo0sg/SUpdate.ini?dl=1

http://xred.site50.net/syn/SUpdate.ini

https://docs.google.com/uc?id=0BxsMXGfPIZfSVzUyaHFYVkQxeFk&export=download

https://www.dropbox.com/s/zhp1b06imehwylq/Synaptics.rar?dl=1

http://xred.site50.net/syn/Synaptics.rar

https://docs.google.com/uc?id=0BxsMXGfPIZfSTmlVYkxhSDg5TzQ&export=download

https://www.dropbox.com/s/fzj752whr3ontsm/SSLLibrary.dll?dl=1

http://xred.site50.net/syn/SSLLibrary.dll

Extracted

Family

asyncrat

C2

199.7.140.5:8848
199.7.140.5:80
199.7.140.5:10512

Attributes

delay
1
install
true
install_file
123.exe
install_folder
%AppData%
local_host
127.0.0.1

aes.plain

Targets

- Target
  96878f369e1761087c53949975076b6a4e36423fdf67367efba9e6e62acb7a5e
- Size 3.3MB
- SHA256 96878f369e1761087c53949975076b6a4e36423fdf67367efba9e6e62acb7a5e
- MD5 5295e4a041a1f45f10428309aac02f29
- SHA1 b6ad61ac273df5bb1fd889e426a6364a98237eb8
- SHA512 0c72fbf405dd3470566eab75dd3a1e9823e6be94217cc64bda4fe7775fc647f9c985ea3805f4675d8b0cb1efa263dd09268a699f85c1f292415a258736ea498c
- SSDEEP 49152:sCwsbCANnKXferL7Vwe/Gg0P+Wh3zJKwnsHyjtk2MYC5GD2X:/ws2ANnKXOaeOgmh3lKwnsmtk2ah
- TLSH
  T1C4F57CB2B19144BAC3F80570DD96D7F25BAC776D2BF2093677EC9DCA3A242483960319
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

backdoor discovery execution asyncrat gh0strat purplefox xred persistence rat rootkit trojan upx
- Async RAT payload
  rat
- Detect PurpleFox Rootkit
  Detect PurpleFox Rootkit.
  rootkit
- Family: AsyncRat
  AsyncRAT is designed to remotely monitor and control other computers written in C#.
  rat asyncrat
- Family: Gh0strat
  Gh0st RAT is a remote access tool (RAT) with its source code public and it has been used by multiple Chinese groups.
  rat gh0strat
- Family: PurpleFox
  PurpleFox is an exploit kit used to distribute other malware families and first seen in 2018.
  rootkit trojan purplefox
- Family: Xred
  Xred is backdoor written in Delphi.
  backdoor xred
- Gh0st RAT payload
- Drops file in Drivers directory
- Server Software Component: Terminal Services DLL
  persistence
- Sets service image path in registry
  This determines the executable launched when a service starts. It can be used to establish persistence.
  persistence
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
  persistence
- Drops file in System32 directory
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
behavioral1 behavioral2