asyncrat | 52e289b951177578ab001f7e12482d92[.]exe | Triage

Sharing

General

Target

52e289b951177578ab001f7e12482d92.exe
Size

224KB
MD5

52e289b951177578ab001f7e12482d92
SHA1

cc281f215277e6e33f3bfbfc32047b8540a43034
SHA256

fdf6c95e1a226fcc95bdaf82f191f54c3acbf1a7f2747ff3d58f083834f7ec5a
SHA512

36d469eb5cad7dbd7226f7c31baca2d6631ea7cc775c1c1dddecbc44bd235144a08e01e502b4d83b008a9edbbf67fa0ef2332a9bbc03d6d0b487f8368804c107
SSDEEP

3072:IuwMTgp/21fEFUzxObbIuyycoNcxlD2QQYYYYu2PYYYDzeYbYa3EPED+vOh+:IuwhO12Uzcbr8hlD2QrL3o

Score

10^/10

rat default asyncrat

Malware Config

Extracted

Family

asyncrat

Version

0.5.7B

Botnet

Default

C2

195.206.235.234:1907

Mutex

AsyncMutex_6SIu8OkPnk

Attributes

delay
3
install
false
install_folder
%AppData%

aes.plain

Signatures

Async RAT payload 1 IoCs

resource	yara_rule
sample	asyncrat

Asyncrat family
asyncrat

Files

52e289b951177578ab001f7e12482d92.exe
.exe windows x86

f34d5f2d4577ed6d9ceec516c1f5a744

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

mscoree

_CorExeMain

Sections

.text
Size: 44KB - Virtual size: 44KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 178KB - Virtual size: 178KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ