asyncrat | cbedcca6956457e43397a42f31cd90b9eb4160ca24ff96fa59fba34ce0b03e30

Target
AsyncClient.exe
Size 45KB
Sample261022-yvx4vafs7y
SHA256 cbedcca6956457e43397a42f31cd90b9eb4160ca24ff96fa59fba34ce0b03e30
MD5 8543cda2d2955099f1f2b95dd8ac4fe4
SHA1 246e7b73c9ddddcf3ff32efc85eb433302897621
SHA512 c6864f2e848b598d2552f48cd1efa7f3550ba5b701b07b09157f9c953af450677eee5db6a9ec08d35be0fea009ff86c67135d47c2fc3ebfb319540626d1cc62d
SSDEEP 768:RuyN5TdMhGqWU8Durmo2qrlOjPGagAWOzjbFgX3il1sjzleIBevccDZqf+:RuyN5TdCf2kOTKTO3bCXSl0lTBWTdqf+
TLSH
T16B231B003BE9822BF2BE4F7899F26145867AF2632603D54E1CC451DB5613FC69A426FE
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Extracted

Family

asyncrat

Version

0.5.8

Botnet

Default

echodex.io:6606
echodex.io:7707
echodex.io:8808
echodex.io:443
echodex.io:80
echodex.io:8844
echodex.io:22
echodex.io:53
popit.io:6606
popit.io:7707
popit.io:8808
popit.io:443
popit.io:80
popit.io:8844
popit.io:22
popit.io:53
www.pdf-books.org:6606
www.pdf-books.org:7707
www.pdf-books.org:8808
www.pdf-books.org:443
www.pdf-books.org:80
www.pdf-books.org:8844
www.pdf-books.org:22
www.pdf-books.org:53
skytrust.io:6606
skytrust.io:7707
skytrust.io:8808
skytrust.io:443
skytrust.io:80
skytrust.io:8844
skytrust.io:22
skytrust.io:53

Mutex

FtTRmAL1FxCo

Attributes

delay
3
install
false
install_folder
%AppData%

aes.plain

Extracted

Path

C:\Program Files\7-Zip\Lang\DECRYPT_YOUR_FILES.HTML

Ransom Note

<html> <head> <style> body{ background-color: #3366CC; } h1 { background-color: RGB(249, 201, 16); } p { background-color: maroon; color: white; } </style> </head> <body> <center> <h1><b> Attention ! All your files </b> have been encrypted. </h1></br> <p> Due encrypting was used algoritm RSA-4096 and AES-256, used for protection military secrets.</br> That means > RESTORE YOU DATA POSIBLE ONLY BUYING decryption passwords from us.</br> Getting a decryption of your files is - SIMPLY task.</br></br> That all what you need:</br> 1. Sent Your ID_KEY on mailbox [email protected] or [email protected] </br> 2. For test, decrypt 2 small files, to be sure that we can decrypt you files.</br> 3. Pay our services. </br> 4. GET software with passwords for decrypt you files.</br> 5. Make measures to prevent this type situations again.</br></br> IMPORTANT(1)</br> Do not try restore files without our help, this is useless, and can destroy you data permanetly.</br></br> IMPORTANT(2) </br> We Cant hold you decryption passwords forever. </br>ALL DECRYPTION PASSWORDS, for what wasn`t we receive reward, will destroy after week of moment of encryption. </p> <p> Your ID_KEY: <br> </p> <table width="1024" border="0"> <tbody> <tr> <td><p>kT+i1s0D88edmjwA1JqIhoIQL5WgBdWnH/KnJfnm6MVkTXVOIuSF4IA0O9RI67QciH4+s68cHjBUpqqMAvJujsrCTPLG1VE3OPSqvSLuv+RPtvxOW6yhb1KpT6Im1Zp0kJJ8uBQ3AAUxg8yCKQetwhTLXKRJ+K5QoRtImm3J/0VaRiX9MbvZfuIitFYkgWZhqkq6BiAbWtU0Px/N3lttrmgbsUzDeY28Gta2vpfuzHk3WIyZkIvfmOMZxFJsK4z9SffVNti594XiTH/VlJiWNn/KMSJmglTX/4Mcpu9LMDdRCPwZL3b/BSXH0+wgDoZzHOTjR0CzJy65/Divy7Jw8A==ZW4tVVM=</p></td> </tr> </tbody> </table> </center></html></body>

Emails

Targets

- Target
  AsyncClient.exe
- Size 45KB
- SHA256 cbedcca6956457e43397a42f31cd90b9eb4160ca24ff96fa59fba34ce0b03e30
- MD5 8543cda2d2955099f1f2b95dd8ac4fe4
- SHA1 246e7b73c9ddddcf3ff32efc85eb433302897621
- SHA512 c6864f2e848b598d2552f48cd1efa7f3550ba5b701b07b09157f9c953af450677eee5db6a9ec08d35be0fea009ff86c67135d47c2fc3ebfb319540626d1cc62d
- SSDEEP 768:RuyN5TdMhGqWU8Durmo2qrlOjPGagAWOzjbFgX3il1sjzleIBevccDZqf+:RuyN5TdCf2kOTKTO3bCXSl0lTBWTdqf+
- TLSH
  T16B231B003BE9822BF2BE4F7899F26145867AF2632603D54E1CC451DB5613FC69A426FE
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

default defense_evasion discovery asyncrat fantom snakebot installer persistence privilege_escalation ransomware rat snakebot themida trojan
- Family: AsyncRat
  AsyncRAT is designed to remotely monitor and control other computers written in C#.
  rat asyncrat
- Family: Fantom
  Ransomware which hides encryption process behind fake Windows Update screen.
  ransomware fantom
- Family: SnakeBOT
  SnakeBOT is a heavily obfuscated .NET downloader.
  snakebot
- Contains SnakeBOT related strings
  snakebot
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
  defense_evasion
- Renames multiple (2074) files with added filename extension
  This suggests ransomware activity of encrypting all the files on the system.
  ransomware
- Badlisted process makes network request
  Network request originating from process or tool commonly abused by malware.
- Disables Task Manager via registry modification
  defense_evasion
- Downloads MZ/PE file
- Checks BIOS information in registry
  BIOS information is often read in order to detect sandboxing environments.
- Creates a file in the Startup directory
  A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.
  persistence privilege_escalation
- Executes dropped EXE
- Loads dropped DLL
- Themida packer
  Detects Themida, an advanced Windows software protection system.
  themida
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
- Checks whether UAC is enabled
  defense_evasion trojan
- Contacts third-party web service commonly abused for C2
  Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.
- Probable phishing domain
- Suspicious use of NtSetInformationThreadHideFromDebugger
  defense_evasion
behavioral1