Overview

overview

10

Static

static

10

work/asyncrat.exe

windows7-x64

10

work/asyncrat.exe

windows10-2004-x64

10

work/async...ed.ps1

windows7-x64

1

work/async...ed.ps1

windows10-2004-x64

1

work/dynwrapx.dll

windows7-x64

1

work/dynwrapx.dll

windows10-2004-x64

1

Sharing

Copy URL Twitter E-mail

General

  • Target

    remcos.zip

  • Size

    52KB

  • MD5

    87c386fca6a77e9d7692962b37e20393

  • SHA1

    d9667b4aee3c2e2181b94254874edaaa56fe599d

  • SHA256

    2bd325fa05c5184178ff65feacb70183c180e3e119ba77dc52b5171a952fde61

  • SHA512

    8eb234db75b72b777683dec24bb6d988217401b930a22b4f22b1ec93146680b4569eebd30096ac9e61d779d7110e4924f3c58a5f7a8cdbf6cc89a39fd91e65a7

  • SSDEEP

    1536:E04Dv7GgXqIi/0S1SEnBb0x22ZTzRZA/PI:B+GcI/0ynyHnRZcI

Score
10/10
ratnewyourkasyncrat

Malware Config

Extracted

Family

asyncrat

Version

1.0.7

Botnet

NewYourk

C2

141.95.84.40:3060

Mutex

XWXWXWXWXWXW

Attributes
  • delay

    1

  • install

    false

  • install_folder

    %AppData%

aes.plain

Signatures

  • Async RAT payload 1 IoCs
    rat
  • Asyncrat family
    asyncrat

Files

  • remcos.zip
    .zip

    Password: infected

  • work/asyncrat.bin
    .exe windows x86

    Password: infected

    f34d5f2d4577ed6d9ceec516c1f5a744


    Headers

    Imports

    Sections

  • work/asyncrat_decompiled.out
    .ps1
  • work/disassembly_shellcode.txt
  • work/dynwrapx.dll
    .dll regsvr32 windows x86

    Password: infected

    5c1de943a8b81217d14da612c0c5b40a


    Headers

    Imports

    Exports

    Sections