asyncrat | Stub[.]exe

General

Target
Stub.exe
Size 61KB
Sample221220-a8869sbe8v
SHA256 32e23296c65a1fea033fbbe400eb4b33be1ba4c8541ad4caac33f7dac05b39a3
MD5 fee237cb83b0b73721200b2d04f73f45
SHA1 34070b24bc700633414ec3989bc8e7fed937a673
SHA512 73c0e500ef836f63c6bb8c1510cd491cbda4029b84895d8f01e88bac4c97f90220318bb270ef9891a83db62767d6159cace38a6cb01fb8b8cace81652207f685
SSDEEP 1536:OA5+1k/25eolxTOGbXPtUj8Vpb/6HnW1NmOPtgeZq7vx:OA5+1k/25em6Gbf2gVpb/NuIqrx
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

rat default asyncrat

Malware Config

Extracted

Family

asyncrat

Version

| Edit 3LOSH RAT

Botnet

Default

C2

wpmediatech.com:6666

Mutex

AsyncMutex_xe

Attributes

delay
3
install
false
install_folder
%AppData%

aes.plain

Signatures

Async RAT payload 1 IoCs

rat

resource	yara_rule
sample	asyncrat

Asyncrat family
asyncrat

File Explorer

Stub.exe

.exe 61KB

Stub.exe

IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
SHA256 32e23296c65a1fea033fbbe400eb4b33be1ba4c8541ad4caac33f7dac05b39a3
MD5 fee237cb83b0b73721200b2d04f73f45
SHA1 34070b24bc700633414ec3989bc8e7fed937a673
SHA512 73c0e500ef836f63c6bb8c1510cd491cbda4029b84895d8f01e88bac4c97f90220318bb270ef9891a83db62767d6159cace38a6cb01fb8b8cace81652207f685
SSDEEP 1536:OA5+1k/25eolxTOGbXPtUj8Vpb/6HnW1NmOPtgeZq7vx:OA5+1k/25em6Gbf2gVpb/NuIqrx
MD5 SHA1 SHA512 SSDEEP

windows x86

Async RAT payload

rat

Minor OS version

Major OS version

Entry point

68078

Magic Number

267

Subsystem

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

Sharing