Overview
overview
10Static
static
1070488131ff...ce.exe
windows7-x64
1070488131ff...ce.exe
windows10-1703-x64
1070488131ff...ce.exe
windows10-2004-x64
10RustExternal_nls.exe
windows7-x64
8RustExternal_nls.exe
windows10-1703-x64
8RustExternal_nls.exe
windows10-2004-x64
8SecuriteIn...58.exe
windows7-x64
10SecuriteIn...58.exe
windows10-1703-x64
10SecuriteIn...58.exe
windows10-2004-x64
10payload.exe
windows7-x64
10payload.exe
windows10-1703-x64
10payload.exe
windows10-2004-x64
10Behavioral task
behavioral1
Sample
70488131ff53f7f73f351f27f86a10ce.exe
Resource
win7-20221111-en
Behavioral task
behavioral2
Sample
70488131ff53f7f73f351f27f86a10ce.exe
Resource
win10-20220812-en
Behavioral task
behavioral3
Sample
70488131ff53f7f73f351f27f86a10ce.exe
Resource
win10v2004-20221111-en
Behavioral task
behavioral4
Sample
RustExternal_nls.exe
Resource
win7-20221111-en
Behavioral task
behavioral5
Sample
RustExternal_nls.exe
Resource
win10-20220812-en
Behavioral task
behavioral6
Sample
RustExternal_nls.exe
Resource
win10v2004-20221111-en
Behavioral task
behavioral7
Sample
SecuriteInfo.com.Variant.MSILPerseus.238084.18099.17658.exe
Resource
win7-20220901-en
Behavioral task
behavioral8
Sample
SecuriteInfo.com.Variant.MSILPerseus.238084.18099.17658.exe
Resource
win10-20220812-en
Behavioral task
behavioral9
Sample
SecuriteInfo.com.Variant.MSILPerseus.238084.18099.17658.exe
Resource
win10v2004-20221111-en
Behavioral task
behavioral10
Sample
payload.exe
Resource
win7-20220812-en
Behavioral task
behavioral11
Sample
payload.exe
Resource
win10-20220812-en
General
-
Target
asyncrat.zip
-
Size
9.5MB
-
MD5
60f2daf47f768b9cb27617df220516ad
-
SHA1
93acdf9fe13e4d72f17958b0309c74f5027e16d2
-
SHA256
d0620352e37834e441d47fe68839af198244790bcd7327aa0862dde39defc886
-
SHA512
0ed47788ebaeebaa11ecdcc881c43e1d51f4551d5c8c16143636f4129bbe36822e849fcef3052d72586ca66958bd79f80f3bfb3ae83d49890d1f2cb95d7a39d6
-
SSDEEP
196608:6K4jrfNpXw1c9EKSuQjzKCK/f5pRfHmSrEW/3ueoh3hqfZa:ybNkcyKBcFK/tfHm6fDqhqM
Malware Config
Extracted
asyncrat
| Edit 3LOSH RAT
Default
nasori.ddnsfree.com:6666
AsyncMutex_6SI8OkPnk
-
delay
3
-
install
false
-
install_folder
%AppData%
Signatures
Files
-
asyncrat.zip.zip
Password: infected
-
__MACOSX/asyncrat/._.DS_Store
-
__MACOSX/asyncrat/._308f16cf7000655a28f21e6d159ac68740d6c8437b2a83baaa563912a2bf7a19.zip
-
__MACOSX/asyncrat/._c6dda31fa6cb4ce140f62c9ce604672fa4a9ba5d1792f2d77f3cfcb43b3227ac.zip
-
__MACOSX/asyncrat/._cd2c63e16f4c1e79e7763c278146acae54dca752c25ad46d47167f69d70d714a.zip
-
__MACOSX/asyncrat/._e5b7fd44374ca6eeab6de255d2f3a379dbef68a8fad0fc3aa34b746172a22758.zip
-
asyncrat/.DS_Store
-
asyncrat/308f16cf7000655a28f21e6d159ac68740d6c8437b2a83baaa563912a2bf7a19.zip.zip
Password: infected
-
70488131ff53f7f73f351f27f86a10ce.exe.exe windows x86
Password: infected
f34d5f2d4577ed6d9ceec516c1f5a744
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
mscoree
_CorExeMain
Sections
.text Size: 84KB - Virtual size: 84KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
-
asyncrat/c6dda31fa6cb4ce140f62c9ce604672fa4a9ba5d1792f2d77f3cfcb43b3227ac.zip.zip
Password: infected
-
RustExternal_nls.exe.exe windows x86
Password: infected
f34d5f2d4577ed6d9ceec516c1f5a744
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
mscoree
_CorExeMain
Sections
.text Size: 618KB - Virtual size: 618KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 39KB - Virtual size: 38KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
-
asyncrat/cd2c63e16f4c1e79e7763c278146acae54dca752c25ad46d47167f69d70d714a.zip.zip
Password: infected
-
SecuriteInfo.com.Variant.MSILPerseus.238084.18099.17658.exe.exe windows x86
Password: infected
f34d5f2d4577ed6d9ceec516c1f5a744
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
mscoree
_CorExeMain
Sections
x5CDBdn Size: 6.3MB - Virtual size: 6.3MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.text Size: 8.4MB - Virtual size: 8.4MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 2KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Size: 512B - Virtual size: 16B
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
-
asyncrat/e5b7fd44374ca6eeab6de255d2f3a379dbef68a8fad0fc3aa34b746172a22758.zip.zip
Password: infected
-
payload.exe.exe windows x86
Password: infected
f34d5f2d4577ed6d9ceec516c1f5a744
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
mscoree
_CorExeMain
Sections
.text Size: 58KB - Virtual size: 57KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 2KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ