asyncrat | 26b35f04cd53782196ef2f56f1f0b37866f0b685c7e2e4c8b84495e01c91917f

General

Target
an.zip
Size 162KB
Sample260916-xa6d2ssxbv
SHA256 26b35f04cd53782196ef2f56f1f0b37866f0b685c7e2e4c8b84495e01c91917f
MD5 294f3c066e09a92e79842b886c20a730
SHA1 1080f4827b330ca8939353d5d20248adfaec0dce
SHA512 883ab172a6da46b1718b1037f7f54ed492e7502fa460d8997516e01fa7f97746fe5448515f3e99250edb6c134df3c48ccdd11b3d39b7a2106d1606f9e565754d
SSDEEP 3072:TfaKfHIaqqBa5X4LJF++C68h9lN5OVoYITGTR3HWAkmTsu0ODazC8tM8:T1fESgXKJ58rlHOeETR3HWAkmTdLuzCq
TLSH
T109F3233A0DE866D8D0A3B57441CD013591BC616C1F262E7A7C05FEE9982D1EABCD07BA
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Extracted

Family

asyncrat

Version

0.5.7B

Botnet

Default

C2

uejrhnfq.duckdns.org:6745

Mutex

AsyncMutex_6SI8OkPnk

Attributes

delay
3
install
false
install_folder
%AppData%

aes.plain

Targets

- Target
  activate_srqz7q.bat
- Size 129KB
- SHA256 207d964e8254633cff1059ed62c2cc9fe67cedd83094bb2b61b9a430f924749b
- MD5 36b2a81e046bdbcf438317f685f17d41
- SHA1 acf11ac10a46274783b865dd2b499a45c2aaa3ca
- SHA512 05d31b2b2e3f908109edabbe9bf52da4a343f41df2c2677c2826ca5aeb0791d32123f60fc34a420bd856e3708741399e13d2e5b2a978e00f29a931b1daf2c861
- SSDEEP 1536:ojAkqhm2N/8ptvCPNlDuzpn5zYhbZaOOvx2MQl+5mgnAlsTMbHGISlwq34Q2UjNd:o5qUtvINlkPyt2HP5mGbqml1Iend
- TLSH
  T167D3463D3F1569883E6E4946CE3C6858BC2FF9976BF0DC49A897F43621A54D87B0C508
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

default defense_evasion discovery execution asyncrat donutloader loader rat
- Async RAT payload
  rat
- Detects DonutLoader
  loader
- Family: AsyncRat
  AsyncRAT is designed to remotely monitor and control other computers written in C#.
  rat asyncrat
- Family: DonutLoader
  DonutLoader is a position-independent code that enables in-memory execution of VBScript, JScript, EXE, DLL files and dotNET assemblies.
  loader donutloader
- Loads dropped DLL
- Deobfuscate/Decode Files or Information
  Payload decoded via CertUtil.
  defense_evasion
behavioral1 behavioral2
- Target
  sechost_o4f32s.dll
- Size 14KB
- SHA256 8e248505b6cd87d2e27ed40541c2b2933113380da27bc75458d62d419e732f8d
- MD5 609148a3a0c5eff84a22ff8900a5afff
- SHA1 c253fdcb5e2b408832b9de61a8c6c553d2d712f8
- SHA512 54344cf339c8f465680bdae0d90917a230562b8afed83e92d6aeacb3079e651a128c9fb8a0463ea4d61564aecc976a724014bcea03b4b3fa65015668f54a46d5
- SSDEEP 192:qutinEng2LH7Ilv81KM2151/e3m0Sd4L:qutiegMH4gdWb/qSd4L
- TLSH
  T1D452B80D325388D9C54AC47991EB8FB8EAF5B901C5E75B388334DA363E607A5772AE01
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

default asyncrat donutloader loader rat
- Async RAT payload
  rat
- Detects DonutLoader
  loader
- Family: AsyncRat
  AsyncRAT is designed to remotely monitor and control other computers written in C#.
  rat asyncrat
- Family: DonutLoader
  DonutLoader is a position-independent code that enables in-memory execution of VBScript, JScript, EXE, DLL files and dotNET assemblies.
  loader donutloader
behavioral3 behavioral4