General
-
Target
2dee6cc5f17ee1ec0c242ed80d7915d9.exe
-
Size
51KB
-
MD5
2dee6cc5f17ee1ec0c242ed80d7915d9
-
SHA1
bb1dd0e46e91c777d09bbbb2836a8f4f353776f3
-
SHA256
19fbd654e6dc76fc4a55bbc3c5dccc866d654c1609f8b72a130bd687d11f6198
-
SHA512
3a85dc2828b049aa9a2fe3f81f4e4a328f32fb9f848e7bf146f03ff326cf045fce4a0f72d2c263e3fe4d1dc27dc1389acefde961b092171715f7e6f8388ea9cc
-
SSDEEP
768:rVLY/OU+8FdcmRdH70KbyMka++wo79EbJISuFh177jbfgQKiqNAKMHSaReyx:rVLY/OUfV08YbJIdnboQlqNApFReyx
Malware Config
Extracted
asyncrat
| Edit 3LOSH RAT
New Crypt
aboreda.linkpc.net:6666
AsyncMutex_6SI8OkPnk
-
delay
3
-
install
false
-
install_file
Webrootupdate.exe
-
install_folder
%AppData%
Signatures
Files
-
2dee6cc5f17ee1ec0c242ed80d7915d9.exe.exe windows x86
f34d5f2d4577ed6d9ceec516c1f5a744
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
mscoree
_CorExeMain
Sections
.text Size: 48KB - Virtual size: 47KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 2KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ