asyncrat | client[.]bin[.]exe

General

Target
client.bin.exe
Size 144KB
Sample221021-halx3sfffl
SHA256 9160b90fa4a6a9cf22f943dba92cec64e2dc03c2317b5d9ab50a753fc410ce43
MD5 f4fdcb900e7af47100ac9e46945fbd55
SHA1 c1d235a9a2cae8d5a8d4f6ceb4eab9417e1b1fb2
SHA512 236eef98d4695a5e1224a87a1dc598639e5c49f6dd192a96cc1b9f8305faa57078deb62d73906a33ba1c1fac4fa5ccc5f344a0f196dbba718b76a36667984ac2
SSDEEP 3072:Bsp9iv+DYM5ob0HGNSKsstcnZTJQDgWPaySsdH5boWz:Op9iTMSb0mgKFcQjhdH
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

rat %group%asyncrat arrowrat

Malware Config

Extracted

Family

arrowrat

Botnet

%Group%

C2

%Hosts%:%Ports%

Mutex

%MTX%

Signatures

Arrowrat family
arrowrat

Async RAT payload 1 IoCs

rat

resource	yara_rule
sample	asyncrat

Asyncrat family
asyncrat

File Explorer

client.bin.exe

.exe 144KB

client.bin.exe

IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
SHA256 9160b90fa4a6a9cf22f943dba92cec64e2dc03c2317b5d9ab50a753fc410ce43
MD5 f4fdcb900e7af47100ac9e46945fbd55
SHA1 c1d235a9a2cae8d5a8d4f6ceb4eab9417e1b1fb2
SHA512 236eef98d4695a5e1224a87a1dc598639e5c49f6dd192a96cc1b9f8305faa57078deb62d73906a33ba1c1fac4fa5ccc5f344a0f196dbba718b76a36667984ac2
SSDEEP 3072:Bsp9iv+DYM5ob0HGNSKsstcnZTJQDgWPaySsdH5boWz:Op9iTMSb0mgKFcQjhdH
MD5 SHA1 SHA512 SSDEEP

windows x86

Async RAT payload

rat

Minor OS version

Major OS version

Entry point

151502

Magic Number

267

Subsystem

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

Sharing