Unmasking AsyncRAT New Infection Chain | McAfee Blog
Tags
cmtmf-attack-pattern: Process Injection
attack-pattern: Data Credentials - T1589.001 Javascript - T1059.007 Keylogging - T1056.001 Keylogging - T1417.001 Malware - T1587.001 Malware - T1588.001 Powershell - T1059.001 Process Injection - T1631 Scheduled Task - T1053.005 Server - T1583.004 Server - T1584.004 Powershell - T1086 Process Injection - T1055 Scheduled Task - T1053
Show in Graph
Common Information
Type Value
UUID f57b11fa-4e32-4f99-aa93-f50d9b827899
Fingerprint e4458dc083360bc7
Analysis status DONE
Considered CTI value 2
Text language
Published Nov. 3, 2023, 12:53 p.m.
Added to db Nov. 19, 2023, 2:06 a.m.
Last updated Nov. 12, 2024, 11:50 a.m.
Headline Unmasking AsyncRAT New Infection Chain
Title Unmasking AsyncRAT New Infection Chain | McAfee Blog
Detected Hints/Tags/Attributes 44/2/19
Source URLs
Redirection Url
Details Source https://www.mcafee.com/blogs/other-blogs/mcafee-labs/unmasking-asyncrat-new-infection-chain/
Details Source https://www.mcafee.com/blogs/other-blogs/mcafee-labs/unmasking-asyncrat-new-infection-chain/?&web_view=true
URL Provider
Details Provider Source level domain
Details mcafee.com www.mcafee.com
RSS Feed
Details Id Enabled Feed title Url Added to db
Details 163 ✔ — https://media.cert.europa.eu/rss?type=category&id=Malware&language=en&duplicates=false 2024-08-30 22:08
Details 333 ✔ — https://www.mcafee.com/blogs/other-blogs/mcafee-labs/feed/ 2024-08-30 22:08
Attributes
Details Type #Events CTI Value
Details Domain 285 
microsoft.net
Details File 72 
regsvcs.exe
Details File 1 
xral.ps1
Details File 1 
xral.vbs
Details File 61 
1.bat
Details File 1 
hrlm.ps1
Details File 13 
log.tmp
Details sha256 2 
83c96c9853245a32042e45995ffa41393eeb9891e80ebcfb09de8fae8b5055a3
Details sha256 2 
97f91122e541b38492ca2a7c781bb9f6b0a2e98e5b048ec291d98c273a6c3d62
Details sha256 2 
ac6c6e196c9245cefbed223a3b02d16dd806523bba4e74ab1bcf55813cc5702a
Details sha256 2 
0159bd243221ef7c5f392bb43643a5f73660c03dc2f74e8ba50e4aaed6c6f531
Details sha256 2 
f123c1df7d17d51115950734309644e05f3a74a5565c822f17c1ca22d62c3d99
Details sha256 2 
19402c43b620b96c53b03b5bcfeaa0e645f0eff0bc6e9d1c78747fafbbaf1807
Details sha256 2 
34cb840b44befdd236610f103ec1d0f914528f1f256d9ab375ad43ee2887d8ce
Details sha256 2 
1c3d5dea254506c5f7c714c0b05f6e2241a25373225a6a77929e4607eb934d08
Details sha256 2 
83b29151a192f868362c0ecffe5c5fabe280c8baac335c79e8950fdd439e69ac
Details IPv4 2 
45.12.253.107
Details Url 2 
http://45.12.253.107:222/f.txt
Details Url 2 
http://45.12.253.107:222/j.jpg