asyncrat | Stub[.]exe | Triage

Sharing

General

Target

Stub.exe
Size

61KB
MD5

8d8ba183b96eaa5fe721060b7f37905c
SHA1

f67a05770055305a97fc559ad78a7360cd7d317c
SHA256

8af96920cc3565dea5bd923d276be018f1fd259943e99d1c5c7ed9abd61f13e5
SHA512

94aeea14baac25c6d2c3ba7178f2cd3e1e4c83c70e773909222cee379e3d8cf6629accd271dc470316afadf0ffa33da2a12b4ab6987a97573dc4d0f653721d54
SSDEEP

1536:l26UKVZnSSTAd6HozOqSsa9xb33TZumWUbbHx:l26UKVZSSTAEIzwsaHb33ccbjx

Score

10^/10

rat 29-10 asyncrat

Malware Config

Extracted

Family

asyncrat

Version

| Edit 3LOSH RAT

Botnet

29-10

C2

vrln.linkpc.net:7777

Mutex

AsyncMutex_fBxs

Attributes

delay
3
install
false
install_folder
%AppData%

aes.plain

Signatures

Async RAT payload 1 IoCs

resource	yara_rule
sample	asyncrat

Asyncrat family
asyncrat

Files

Stub.exe
.exe windows x86

f34d5f2d4577ed6d9ceec516c1f5a744

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

mscoree

_CorExeMain

Sections

.text
Size: 58KB - Virtual size: 57KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ