asyncrat | tmpy37iczrk | Triage

Sharing

Copy URL Twitter E-mail

General

Target

tmpy37iczrk
Size

45KB
MD5

46d1e03b7d6f5ef05c728ddddb1d8a8f
SHA1

c3b43e21420eb6a6bf3c85d5a278c51fe5b47c89
SHA256

00175798dec9209ec22acf95a8484f3fcc58524973ff82111268dc117f3647ad
SHA512

e0dc9834889c26c64a36c2fd11e7256b4d0702991f16ec32009f6d08a1f2a05c462432bdd522ddf6cc7c4a0306a5d92bf46e4c168f34ce3d4b1c9fc246be7559
SSDEEP

768:Du/6ZTgoiziWUUM9rmo2qrF62F9xX8fKduPIgYzjbGgX3IeRq6231n2YBDZfx:Du/6ZTgle2Y6UlB3bZXYeDe1n2edfx

Score

10^/10

rat default asyncrat

Malware Config

Extracted

Family

asyncrat

Version

0.5.7B

Botnet

Default

C2

handofhor.duckdns.org:8891

Mutex

AsyncMutex_6SI8OkPnk

Attributes

delay
3
install
false
install_folder
%AppData%

aes.plain

Signatures

Async RAT payload 1 IoCs

resource	yara_rule
sample	asyncrat

Asyncrat family
asyncrat

Files

tmpy37iczrk
.exe windows x86

f34d5f2d4577ed6d9ceec516c1f5a744

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

mscoree

_CorExeMain

Sections

.text
Size: 42KB - Virtual size: 41KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ