asyncrat | CrystalPlay Launcher Updated[.]rar | Triage

Sharing

Copy URL Twitter E-mail

General

Target

CrystalPlay Launcher Updated.rar
Size

313KB
MD5

0df4e7eff57302abc9a74526d98ab612
SHA1

87b561060c1e8768060c3ff34f56cb379fceecc9
SHA256

3cb2f52ab0059d59f0e8fc024691f1ededf1fbb6ee876c25383bdf6d31ba9aa9
SHA512

5d9b08a8b36451bc28405646e649f2ae2a153391ad2c5a06ce43065205d390c8d8d6aea9f35a8d9f9b120a66ee298ed57839a8244feb1f0f0ffb24043d04e3c2
SSDEEP

6144:RrXRfMCQhuczaNEkVBSMN2Hs5JTEm+fk2ZPStFqfCiPsmJ1wa:RT53bianwHs5J92atFyCxmJ1p

Score

10^/10

rat asyncrat

Malware Config

Signatures

Async RAT payload 1 IoCs

resource	yara_rule
static1/unpack001/CrystalPlay Launcher Updated.exe	asyncrat

Asyncrat family
asyncrat

Files

CrystalPlay Launcher Updated.rar
.rar
CrystalPlay Launcher Updated.exe
.exe windows x86

f34d5f2d4577ed6d9ceec516c1f5a744

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE

Imports

mscoree

_CorExeMain

Sections

.text
Size: 389KB - Virtual size: 389KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 197KB - Virtual size: 196KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ