asyncrat | Stub[.]exe | Triage

Sharing

General

Target

Stub.exe
Size

61KB
MD5

fee237cb83b0b73721200b2d04f73f45
SHA1

34070b24bc700633414ec3989bc8e7fed937a673
SHA256

32e23296c65a1fea033fbbe400eb4b33be1ba4c8541ad4caac33f7dac05b39a3
SHA512

73c0e500ef836f63c6bb8c1510cd491cbda4029b84895d8f01e88bac4c97f90220318bb270ef9891a83db62767d6159cace38a6cb01fb8b8cace81652207f685
SSDEEP

1536:OA5+1k/25eolxTOGbXPtUj8Vpb/6HnW1NmOPtgeZq7vx:OA5+1k/25em6Gbf2gVpb/NuIqrx

Score

10^/10

rat default asyncrat

Malware Config

Extracted

Family

asyncrat

Version

| Edit 3LOSH RAT

Botnet

Default

C2

wpmediatech.com:6666

Mutex

AsyncMutex_xe

Attributes

delay
3
install
false
install_folder
%AppData%

aes.plain

Signatures

Async RAT payload 1 IoCs

resource	yara_rule
sample	asyncrat

Asyncrat family
asyncrat

Files

Stub.exe
.exe windows x86

f34d5f2d4577ed6d9ceec516c1f5a744

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

mscoree

_CorExeMain

Sections

.text
Size: 58KB - Virtual size: 58KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ