General

  • Target

    4660-163-0x0000000000400000-0x0000000000412000-memory.dmp

  • Size

    72KB

  • MD5

    c0647207915f60137d9f970e047f28fc

  • SHA1

    6ad2dec9ab49307494f2b2bb42054ea7147df554

  • SHA256

    04553830fc905bba420a6475fdf5cc0ad3bda80e879f23fcddc5b30cf7fbc263

  • SHA512

    b5a6ab6011dc65525959a04b18137d29cd702a76ca30720f2f0159ac4438c09f1064b35afb4445e46bf87be454805203afd5f44aa41778c2fab90e94896c2bdc

  • SSDEEP

    1536:Uuk2VThSa2v0M4ipQBcQqtb0FcNrY3dCj:UukqThSa28M4ipQBEb02r+Yj

Malware Config

Extracted

Family

asyncrat

Version

0.5.7B

Botnet

Windows Sheel Host

C2

20.111.19.215:3152

Mutex

Windows Sheel Host

Attributes
  • delay

    3

  • install

    false

  • install_file

    Windows Sheel Host.exe

  • install_folder

    %AppData%

aes.plain

Signatures

  • Async RAT payload 1 IoCs
  • Asyncrat family

Files

  • 4660-163-0x0000000000400000-0x0000000000412000-memory.dmp
    .exe windows x86


    Headers

    Sections