asyncrat | d125427cd6992d973d998717cf6b797542e7778e0ac4dffcd90aca3a1d550dd8

Sharing

Copy URL Twitter E-mail

General

Target
JsPayloadBuilder 2.zip
Size 17.9MB
Sample260827-ars4qayblh
SHA256 d125427cd6992d973d998717cf6b797542e7778e0ac4dffcd90aca3a1d550dd8
MD5 eee3d5e542c880296dcd86afe7875fee
SHA1 5e79130df175f468baeec623c2042e95affc1262
SHA512 8f8d4783b58f9f886f87daf246db41216efdca8eca6e3e0e637278b1dea38b0d8405b922150b3a590e32143ee2ab330aef6a30af0eeb28c33a1a4b37298ff905
SSDEEP 393216:s2Iu5kPUV9wg+82SHjw1Wq+83F/xd0mvyYf:s2KPO+MHkUTGFp6ba
TLSH
T1C91733983B355108EE18C60B30CC5A8976EE913D38513DF8FC58ABB43E9BCB55DE4989
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Extracted

Family

asyncrat

Version

%ProgramData%

Botnet

js-crypter

Mutex

VN6KXtHmRFqI

Attributes

delay
3
install
false
install_file
WindowsUpdate
install_folder
schtasks

aes.plain

Targets

- Target
  JsPayloadBuilder 2.zip
- Size 17.9MB
- SHA256 d125427cd6992d973d998717cf6b797542e7778e0ac4dffcd90aca3a1d550dd8
- MD5 eee3d5e542c880296dcd86afe7875fee
- SHA1 5e79130df175f468baeec623c2042e95affc1262
- SHA512 8f8d4783b58f9f886f87daf246db41216efdca8eca6e3e0e637278b1dea38b0d8405b922150b3a590e32143ee2ab330aef6a30af0eeb28c33a1a4b37298ff905
- SSDEEP 393216:s2Iu5kPUV9wg+82SHjw1Wq+83F/xd0mvyYf:s2KPO+MHkUTGFp6ba
- TLSH
  T1C91733983B355108EE18C60B30CC5A8976EE913D38513DF8FC58ABB43E9BCB55DE4989
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral1 behavioral2
- Target
  JsPayloadBuilder/Builder.exe
- Size 16.3MB
- SHA256 9d200af52586f8811278e6eaeabff820c5e39d906b32855e487d75f76ef85fc1
- MD5 8a445a712c63336d3234278e74ebba59
- SHA1 88367512250f2e83e6aeb754a2bbfe557ba8a36b
- SHA512 4cc2892c55ecda2b7e5934e287ba3806f17618ba296668f56e58f7e35eae38774b8281392887dcdf91bf67e57c9984c83dd1b1fac55c4ba34e260481b78aeb76
- SSDEEP 196608:8z79DhsqlGN6UEHAE6xTtbW897Gftr1LDsBTG9Wdheuky97aCm75IuYw59R6H6CD:bqLHFc1q3sB1DeXyc1FIuYM6HBD
- TLSH
  T14E0733907B6404D8FD9E623F64C1865393E1B0721BB0DADF2BB40AA93E570E9DE35B41
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

js-crypter defense_evasion discovery execution asyncrat donutloader loader persistence rat
- Async RAT payload
  rat
- Detects DonutLoader
  loader
- Family: AsyncRat
  AsyncRAT is designed to remotely monitor and control other computers written in C#.
  rat asyncrat
- Family: DonutLoader
  DonutLoader is a position-independent code that enables in-memory execution of VBScript, JScript, EXE, DLL files and dotNET assemblies.
  loader donutloader
- Command and Scripting Interpreter: PowerShell
  Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
  execution
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Loads dropped DLL
behavioral3 behavioral4
- Target
  build_gui.pyc
- Size 372KB
- SHA256 e865f4b16545a78fb31f8f215e92ad037fd9a7f7cae97da457ea9a3889ff02d8
- MD5 a07db8ce0d0ff0553280f758e8be727e
- SHA1 d80a403761de28e034e6769756037f5acc1c127f
- SHA512 4db26ea15b536c20a26134cb50a2be301ac8f42f5449e8a013b496058c14a6b892e6bd5e144fde8fecc66ed4393aafdc241a71637f592bbd78b0f5033ec089b6
- SSDEEP 6144:Nt6ZD3rQtdPDtALx5u4795kCgmPmuMr1lM1MDiAfc0XQvxx1N5ZCM4qxCDvLNWR:N8ZvYEDkC/Mr1lM19mhXQlvJR
- TLSH
  T1F584E1318826AC7FDDAEBCB4B8582D402E611A839314C75AF74856BE7BC8704DE5D4BC
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral5 behavioral6
- Target
  JsPayloadBuilder/Launcher.exe
- Size 3.1MB
- SHA256 5d60bf9ea851c152b8c7d40b3525c901c4b69488a08b6b5773d2c3fff0af9dfe
- MD5 d155233d23c89ee22a44fcfff57fbed9
- SHA1 40204add6b66651b1cd150f440ee6dd5dce4961a
- SHA512 9ad0ec1c3c44b1cb3cfee3b244f3c56c7e4b8706df53c08e8eb4fccfda6d898b2747c3fc7bdfa5da4e951569fbc6cd019bbf2b4740d0e537fa772fd25ac3f590
- SSDEEP 49152:27uxUSQIgsp9uMfbOyS0fafiNmN4S785tZhtpQgBsCTOhpCVjiVDWPysmi:27uxUSQIgsp9uMzVyfP41T1OjCVjY
- TLSH
  T1B5E58D5AE7A401A8C1A7C47D895B5013FA7238870775EAEB92F088525F367E02F7E770
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

4^/10
behavioral7 behavioral8
- Target
  JsPayloadBuilder/gui_settings.json
- Size 141B
- SHA256 0d58ca0e97755177edfb6ed3aeb238e5b8c8d843ae2b7d26bb36d7c762919e8e
- MD5 ace464c0c9e578f2e3afecbe34ba8173
- SHA1 f1389ee5e59e59277765b142d54290d593cce31e
- SHA512 1a9f132cb18ba16bc368cf2f14f848a9fc190a266cd9e30386fa1a0db77d3b19503ef9030d4014bd029a61d278f58ab26007ad4c6917f38a91b9a0d0a462d1d9
- TLSH
  T1F9C08C3B8520CC9F103A68D68531741B13518F0831382E2338F3844202C1B31021EA26
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral10 behavioral9
- Target
  JsPayloadBuilder/libGLESv2.dll
- Size 244KB
- SHA256 7bda7e87829de21d7107e382e242f80595a9f91b78226c2b132b1e10a6381ecc
- MD5 f18425eca0ce518c7d97e66402b5fdb6
- SHA1 83fe10b44ec43cf4218129ffa6c51ae8b6bc8b5f
- SHA512 803f35c6a5cca763c6ab02b1d9eceb696d376a2c7d45e13a6f79ded19549eb0b0b8f7bec77b16a05e25ef04e50c305ebb02b6958bf877a7c963d24528d938c69
- SSDEEP 6144:glLU044272uwb5UQv0VSz6y9eOVXqybVDv8W00lGw1hIYmffAzc:+L3442Kug5v0VSuOeUqybSVvw1hIdfWc
- TLSH
  T17734235BA77C9191FE58D6C5B08467842D6E9C031153BC372C53E8C2CEBA4582AA737F
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral11 behavioral12
- Target
  __MACOSX/JsPayloadBuilder/._Builder.exe
- Size 207B
- SHA256 ed8ee0fbf5175f31cd74e270cd27910673a9a6716580709ab3cbd80e9ffc0a81
- MD5 0b32b0ae166a4c52f7714c64da50347a
- SHA1 11234abee3c4ff75126cf57921358f3882bfdde8
- SHA512 33db47aa550b7bc84b40dea752cacfc33a6f4df6c6a26278dec2131550102b05a4e6ffadacf046e759f51d7f9c5f7c3c2d6044cc4e399575000bde192c867e90
- TLSH
  T10CD08C10A1C28882C88100BC24F25802B035A45A01C38212B26DC2002B40A217A903AA
- MD5 SHA1 SHA512 TLSH
Score

1^/10
behavioral13 behavioral14
- Target
  __MACOSX/JsPayloadBuilder/._Launcher.exe
- Size 316B
- SHA256 fa52ef477023e10adda95627c324a842c17e813387a93e96f7eb6f2ebbdba08f
- MD5 cf620770600ab83675e1f4e383159ea4
- SHA1 72607ec7e2528d748fe42438a88d4c7369d03f42
- SHA512 c62b999dfe0b223741b0de54116275fc30d4192c9d6add219d4cd0438c99a47963c84859312536882fcd703520a29e83a12be142a06c9d8287438fcf67230398
- TLSH
  T1CAE0A751E7C25413C09288BC65A6AB01B3A564BC85C65603B62AC5006B65E315DF93FE
- MD5 SHA1 SHA512 TLSH
Score

1^/10
behavioral15 behavioral16
- Target
  __MACOSX/JsPayloadBuilder/._gui_settings.json
- Size 207B
- SHA256 ed8ee0fbf5175f31cd74e270cd27910673a9a6716580709ab3cbd80e9ffc0a81
- MD5 0b32b0ae166a4c52f7714c64da50347a
- SHA1 11234abee3c4ff75126cf57921358f3882bfdde8
- SHA512 33db47aa550b7bc84b40dea752cacfc33a6f4df6c6a26278dec2131550102b05a4e6ffadacf046e759f51d7f9c5f7c3c2d6044cc4e399575000bde192c867e90
- TLSH
  T10CD08C10A1C28882C88100BC24F25802B035A45A01C38212B26DC2002B40A217A903AA
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral17 behavioral18
- Target
  __MACOSX/JsPayloadBuilder/._libGLESv2.dll
- Size 207B
- SHA256 ed8ee0fbf5175f31cd74e270cd27910673a9a6716580709ab3cbd80e9ffc0a81
- MD5 0b32b0ae166a4c52f7714c64da50347a
- SHA1 11234abee3c4ff75126cf57921358f3882bfdde8
- SHA512 33db47aa550b7bc84b40dea752cacfc33a6f4df6c6a26278dec2131550102b05a4e6ffadacf046e759f51d7f9c5f7c3c2d6044cc4e399575000bde192c867e90
- TLSH
  T10CD08C10A1C28882C88100BC24F25802B035A45A01C38212B26DC2002B40A217A903AA
- MD5 SHA1 SHA512 TLSH
Score

1^/10
behavioral19 behavioral20

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

JavaScript

T1059.007

PowerShell

T1059.001

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Extracted

Targets

Async RAT payload

Detects DonutLoader

Family: AsyncRat

Family: DonutLoader

Command and Scripting Interpreter: PowerShell

Checks computer location settings

Executes dropped EXE

Loads dropped DLL

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11

behavioral12

behavioral13

behavioral14

behavioral15

behavioral16

behavioral17

behavioral18

behavioral19

behavioral20