asyncrat | d8d8e2bd36c25798e8243ccb42440baf3f49559a1e251f2f29e70b3d46f597ed

Submit
Reports

Overview

overview

Static

static

012700a410...85.exe

windows10-2004-x64

02a23f59da...1f.exe

windows10-2004-x64

053ddd7019...99.exe

windows10-2004-x64

072f59f857...a5.exe

windows7-x64

072f59f857...a5.exe

windows10-2004-x64

07b9d54ca0...2c.exe

windows10-2004-x64

085092942b...7b.elf

ubuntu-18.04-amd64

085092942b...7b.elf

debian-9-armhf

085092942b...7b.elf

debian-9-mips

085092942b...7b.elf

debian-9-mipsel

08cbd1cc0c...d1.elf

debian-12-armhf

0a50e4e96f...61.exe

windows7-x64

0a50e4e96f...61.exe

windows10-2004-x64

0bdd1bc4a2...54.elf

debian-12-armhf

0c349ec65f...e3.exe

windows10-2004-x64

0c6a7849d4...d3.exe

windows10-2004-x64

0ceb0dadfa...de.elf

debian-9-mips

0dd32a3e7e...85.exe

windows7-x64

0dd32a3e7e...85.exe

windows10-2004-x64

0dd3f8b254...7f.exe

windows10-2004-x64

1100f4a753...15.exe

windows10-2004-x64

124c02ed92...f5.exe

windows7-x64

124c02ed92...f5.exe

windows10-2004-x64

1267a2b9b9...dc.exe

windows7-x64

1267a2b9b9...dc.exe

windows10-2004-x64

13a5b3d41f...f1.exe

windows7-x64

13a5b3d41f...f1.exe

windows10-2004-x64

13a63fbb66...62.exe

windows10-2004-x64

143dea0e6e...5c.exe

windows10-2004-x64

14779e087a...9a.elf

ubuntu-24.04-amd64

15f6ddf672...e3.exe

windows10-2004-x64

16478becee...e4.elf

debian-12-armhf

Resubmissions

23-06-2024 06:12

240623-gyd2psscqf 10

16-07-2023 19:09

230716-xt4pkahc8t 10

Analysis

max time kernel
135s
max time network
161s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
23-06-2024 06:12

Sharing

Copy URL

Twitter E-mail

Static task

static1

18 signatures

Behavioral task

behavioral1

Sample

012700a41078e9d01c70955c50073da3b9b9a163c6fa5776195c278a70bf8c85.exe

Resource

win10v2004-20240611-en

redline duza infostealer persistence

windows10-2004-x64

5 signatures

150 seconds

Behavioral task

behavioral2

Sample

02a23f59da1c37d7ed4e0f14e61fa5b264083dc4bdf35a1b09f0a3d29293981f.exe

Resource

win10v2004-20240508-en

healer redline duza dropper evasion infostealer persistence trojan

windows10-2004-x64

11 signatures

150 seconds

Behavioral task

behavioral3

Sample

053ddd70199526b974c71bb268539790e27247760bbf2680be1e0e82d01fb799.exe

Resource

win10v2004-20240611-en

healer redline grom dropper evasion infostealer persistence trojan

windows10-2004-x64

11 signatures

150 seconds

Behavioral task

behavioral4

Sample

072f59f857e5b792013df1c7916d31ad467fa3dab84c623a44e62ce35f13a3a5.exe

Resource

win7-20240221-en

windows7-x64

1 signatures

150 seconds

Behavioral task

behavioral5

Sample

072f59f857e5b792013df1c7916d31ad467fa3dab84c623a44e62ce35f13a3a5.exe

Resource

win10v2004-20240508-en

windows10-2004-x64

0 signatures

150 seconds

Behavioral task

behavioral6

Sample

07b9d54ca0b731b8a0a8aaa99c2204278d655de9f349d485cd084b2709f0062c.exe

Resource

win10v2004-20240611-en

healer redline grom dropper evasion infostealer persistence trojan

windows10-2004-x64

11 signatures

150 seconds

Behavioral task

behavioral7

Sample

085092942b0623e53eceee98070267fb4f8d6b1f6c866d75389be1868784dd7b.elf

Resource

ubuntu1804-amd64-20240611-en

ubuntu-18.04-amd64

0 signatures

150 seconds

Behavioral task

behavioral8

Sample

085092942b0623e53eceee98070267fb4f8d6b1f6c866d75389be1868784dd7b.elf

Resource

debian9-armhf-20240611-en

debian-9-armhf

0 signatures

150 seconds

Behavioral task

behavioral9

Sample

085092942b0623e53eceee98070267fb4f8d6b1f6c866d75389be1868784dd7b.elf

Resource

debian9-mipsbe-20240418-en

debian-9-mips

0 signatures

150 seconds

Behavioral task

behavioral10

Sample

085092942b0623e53eceee98070267fb4f8d6b1f6c866d75389be1868784dd7b.elf

Resource

debian9-mipsel-20240418-en

debian-9-mipsel

0 signatures

150 seconds

Behavioral task

behavioral11

Sample

08cbd1cc0c473b44845d3960e6af301cb430002f301a55d40dbd03477ad85ed1.elf

Resource

debian12-armhf-20240221-en

debian-12-armhf

0 signatures

150 seconds

Behavioral task

behavioral12

Sample

0a50e4e96fe3948c570214cd5dcdf34b3a2625742eaf15ebdde41d0cd75dea61.exe

Resource

win7-20240611-en

agenttesla collection keylogger spyware stealer trojan

windows7-x64

14 signatures

150 seconds

Behavioral task

behavioral13

Sample

0a50e4e96fe3948c570214cd5dcdf34b3a2625742eaf15ebdde41d0cd75dea61.exe

Resource

win10v2004-20240508-en

agenttesla collection keylogger spyware stealer trojan

windows10-2004-x64

13 signatures

150 seconds

Behavioral task

behavioral14

Sample

0bdd1bc4a24d817604fadd739b1e80cf47722df37c4b2240f6ddfb3c2d120454.elf

Resource

debian12-armhf-20240418-en

debian-12-armhf

0 signatures

150 seconds

Behavioral task

behavioral15

Sample

0c349ec65fde9efebd2ff123c6b223cce44c6fdbafa19b46c12d43eccde3a3e3.exe

Resource

win10v2004-20240508-en

healer redline duza dropper evasion infostealer persistence trojan

windows10-2004-x64

11 signatures

150 seconds

Behavioral task

behavioral16

Sample

0c6a7849d41395e38b5f348c64219356456952602e96e3228379a31e3031a0d3.exe

Resource

win10v2004-20240611-en

redline jason infostealer persistence

windows10-2004-x64

5 signatures

150 seconds

Behavioral task

behavioral17

Sample

0ceb0dadfa894aba36d3629ef69c69540f0cba4fe5d52f7fb0b9663738923bde.elf

Resource

debian9-mipsbe-20240418-en

debian-9-mips

0 signatures

150 seconds

Behavioral task

behavioral18

Sample

0dd32a3e7e27a6cc87ab60dc8a1117956b6eb07a455c2996a43edf71cfa64b85.exe

Resource

win7-20240221-en

dcrat execution infostealer rat

windows7-x64

13 signatures

150 seconds

Behavioral task

behavioral19

Sample

0dd32a3e7e27a6cc87ab60dc8a1117956b6eb07a455c2996a43edf71cfa64b85.exe

Resource

win10v2004-20240226-en

dcrat execution infostealer rat

windows10-2004-x64

15 signatures

150 seconds

Behavioral task

behavioral20

Sample

0dd3f8b25459c4e5e8eabfe91f24381813035cf7c71837ccb6e5f6899e48c27f.exe

Resource

win10v2004-20240611-en

healer redline jason dropper evasion infostealer persistence trojan

windows10-2004-x64

11 signatures

150 seconds

Behavioral task

behavioral21

Sample

1100f4a7535cf8075a78a8da90894ef23cade6fed0d169d44c1738a870630c15.exe

Resource

win10v2004-20240611-en

redline duza infostealer persistence

windows10-2004-x64

5 signatures

150 seconds

Behavioral task

behavioral22

Sample

124c02ed924e11b06b74e1b8c1290adbb1e50dfa2a7bcf95104c6425a1f82ef5.exe

Resource

win7-20240611-en

asyncrat rat

windows7-x64

1 signatures

150 seconds

Behavioral task

behavioral23

Sample

124c02ed924e11b06b74e1b8c1290adbb1e50dfa2a7bcf95104c6425a1f82ef5.exe

Resource

win10v2004-20240508-en

asyncrat rat

windows10-2004-x64

1 signatures

150 seconds

Behavioral task

behavioral24

Sample

1267a2b9b9ff99e4039372e8ee87b8d61ad0a4db0ee052564aee4ddccf2de9dc.exe

Resource

win7-20240508-en

lokibot collection spyware stealer trojan

windows7-x64

9 signatures

150 seconds

Behavioral task

behavioral25

Sample

1267a2b9b9ff99e4039372e8ee87b8d61ad0a4db0ee052564aee4ddccf2de9dc.exe

Resource

win10v2004-20240611-en

lokibot collection spyware stealer trojan

windows10-2004-x64

10 signatures

150 seconds

Behavioral task

behavioral26

Sample

13a5b3d41f084cd25b4142b948e31e80a917c91fff12aa8b156ac9f23c18b0f1.exe

Resource

win7-20240508-en

snakekeylogger collection keylogger spyware stealer

windows7-x64

13 signatures

150 seconds

Behavioral task

behavioral27

Sample

13a5b3d41f084cd25b4142b948e31e80a917c91fff12aa8b156ac9f23c18b0f1.exe

Resource

win10v2004-20240611-en

snakekeylogger collection keylogger spyware stealer

windows10-2004-x64

13 signatures

150 seconds

Behavioral task

behavioral28

Sample

13a63fbb669551bf49f493a5471f08d73b453f35ebeafae1384e9f34dff94462.exe

Resource

win10v2004-20240611-en

redline duza infostealer persistence

windows10-2004-x64

5 signatures

150 seconds

Behavioral task

behavioral29

Sample

143dea0e6ec39e956087e8ed61f409995090455ba38a1e73225a6d87b9d1a55c.exe

Resource

win10v2004-20240508-en

redline duza infostealer persistence

windows10-2004-x64

5 signatures

150 seconds

Behavioral task

behavioral30

Sample

14779e087a764063d260cafa5c2b93d7ed5e0d19783eeaea6abb12d17561949a.elf

Resource

ubuntu2404-amd64-20240523-en

ubuntu-24.04-amd64

0 signatures

150 seconds

Behavioral task

behavioral31

Sample

15f6ddf672086fbd9e4f59fa670c201e101a75e13a71645c982db165fc6e66e3.exe

Resource

win10v2004-20240611-en

redline duza infostealer persistence

windows10-2004-x64

5 signatures

150 seconds

Behavioral task

behavioral32

Sample

16478beceea6d01555ceffc1c582531617a76919cc713c3b72319c19a879b6e4.elf

Resource

debian12-armhf-20240418-en

debian-12-armhf

0 signatures

150 seconds

Report Analysis Logs

General

Target

124c02ed924e11b06b74e1b8c1290adbb1e50dfa2a7bcf95104c6425a1f82ef5.exe
Size

45KB
MD5

8f18dae3a06e5d01df276b48679d87ae
SHA1

eca04933b3034d40113e990a8914a4f9d46b00a0
SHA256

124c02ed924e11b06b74e1b8c1290adbb1e50dfa2a7bcf95104c6425a1f82ef5
SHA512

20e472a03b695550830dde0c27e5cb3edf24bbc672ab2d70fd4c1e97b78ed3399f604d3ab590e2a9f8164a3a01e14b448ca7d88776effdee5078a39e2f138a42
SSDEEP

768:NuwCfTg46YbWUn9jjmo2qrvcPjrhFmsWhzjbdgM3iAvC2oN/TqDiCrcDZTf+:NuwCfTgpM26cLNFm3h3bKMSEK/TqDiH0

Score

10^/10

asyncrat rat

Malware Config

Extracted

Family

asyncrat

Version

0.5.7B

209.25.141.180:6498

Mutex

AsyncMutex_6SI8OkPnk

Attributes

delay
3
install
false
install_folder
%AppData%

aes.plain

Signatures

AsyncRat
AsyncRAT is designed to remotely monitor and control other computers written in C#.
rat asyncrat

Processes

C:\Users\Admin\AppData\Local\Temp\124c02ed924e11b06b74e1b8c1290adbb1e50dfa2a7bcf95104c6425a1f82ef5.exe
"C:\Users\Admin\AppData\Local\Temp\124c02ed924e11b06b74e1b8c1290adbb1e50dfa2a7bcf95104c6425a1f82ef5.exe"
1⤵
PID:4968

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/4968-0-0x00000000748EE000-0x00000000748EF000-memory.dmp

Filesize
4KB

Download
memory/4968-1-0x0000000000890000-0x00000000008A2000-memory.dmp

Filesize
72KB

Download
memory/4968-2-0x00000000748E0000-0x0000000075090000-memory.dmp

Filesize
7.7MB

Download
memory/4968-3-0x00000000748EE000-0x00000000748EF000-memory.dmp

Filesize
4KB

Download
memory/4968-4-0x00000000748E0000-0x0000000075090000-memory.dmp

Filesize
7.7MB

Download