Done a AsyncRAT analysis. The analysis itself mostly consisted of malware binaries reverse engineering using…
Vitalii Bibikov — SOC Analyst, Blue team, Purple team, Incident Response, Inestigation
Done a AsyncRAT analysis. The analysis itself mostly consisted of malware binaries reverse engineering using dnspy, runtime debugging and binary extraction.
The original sample was obtained from MalwareBazaar, where it was tagged as AsyncRAT. However, detailed static and dynamic analysis identified the final payload as XWorm. Although XWorm and AsyncRAT are distinct malware families, both are .NET-based remote-access trojans with broadly similar capabilities, including command-and-control communication, system reconnaissance, remote command execution, surveillance, and plugin-based functionality.
The analyzed malware is a deliberately layered .NET loader whose functionality conceals a complete RAT deployment chain. The malware uses bitmap-based payload storage, reflection by numeric position, runtime delegate resolution, LZMA compressed metadata, multiple custom decryption routines, hidden PowerShell persistence, and process hollowing to make static analysis difficult and to keep intermediate payloads off disk.
The original executable reconstructs OptiMax.dll from the City bitmap. OptiMax decodes ELbT and urs, decrypts a second inmemory assembly, and invokes SystemOptimizerUltimate.dll. System Optimizer verifies persistence, recovers XWormClient26.exe from FYqEoHsR, and hollows a suspended copy of 32-bit MSBuild.exe. The injected XWorm client then performs system discovery and attempts to connect to 192.3.171.223:4445 for remote tasking and connecting the infected host to a botnet to conduct a DDoS activity.
The findings were documented in a malware analysis report structured in the style of a CISA Malware Analysis Report, including technical findings, execution relationships, indicators of compromise, detection opportunities, mitigation recommendations, and MITRE ATT&CK mappings.
The report itself can be found on my Linkedin page: https://www.linkedin.com/in/vitalii-b-828858225/ 🙃
1 reactions · 0 comments