Behavioral task
behavioral1
Sample
fh5BWZAg.exe
Resource
win7-20220812-en
General
-
Target
fh5BWZAg.exe
-
Size
63KB
-
MD5
014fe145a9d6a1a94f5e1950dc3580ad
-
SHA1
f05af2022c03559345c1ed3a38021f50600f7c8f
-
SHA256
797934da336f36e3e80b71e2d48a5ed7453d27394868cac609989ba11f00c734
-
SHA512
9f3205681a4f711cc89675141ab48017a21a05be0cdcb135d9a0e47e7e23105edc639c778443d7d806901886fcfc312d1970d5bb17a7fe154c3405c6515e4a41
-
SSDEEP
1536:NhjExLDRwQuNMXbmaeWs1ljNhhYZq9bbHyqKRLbQGZZVclN:NhjExLDRwQuNMXbreFlzhp9bbHARL1zY
Malware Config
Extracted
asyncrat
1.0.7
Default
5.78.65.18:8848
DcRatMutex_qwqdanchun
-
delay
1
-
install
false
-
install_folder
%AppData%
Signatures
Files
-
fh5BWZAg.exe.exe windows x86
f34d5f2d4577ed6d9ceec516c1f5a744
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
Imports
mscoree
_CorExeMain
Sections
.text Size: 59KB - Virtual size: 58KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 3KB - Virtual size: 3KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ