asyncrat | View[.]bin | Triage

Sharing

General

Target

View.bin
Size

170KB
MD5

f1a98f35102de03ade78f77b4d32672c
SHA1

7c10c2784119e89e71ef22900ded48cfaaef7401
SHA256

7526ce309a80adea50423093cb6bba5c13ee1a3b9e6b4317e6c7f02569aa48cd
SHA512

9a51ddc114286946d823ac36af7b4f56307123d152854e1410d263bae3f7c7b520286b193901710f6be5bc9380e2d1ad79dea2060a8211d5dc006392fb6bc667

Score

10^/10

rat asyncrat stormkitty

Malware Config

Signatures

Async RAT payload 1 IoCs
rat

Processes:

resource yara_rule

sample asyncrat
Asyncrat family
asyncrat
StormKitty Payload 1 IoCs

Processes:

resource yara_rule

sample family_stormkitty
Stormkitty family
stormkitty

Files

View.bin
.exe windows x86

f34d5f2d4577ed6d9ceec516c1f5a744

Code Sign

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Imports

mscoree

_CorExeMain

Sections

.text
Size: 167KB - Virtual size: 167KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ