asyncrat | 1728-70-0x0000000000400000-0x0000000000412000-memory[.]dmp

General

Target
1728-70-0x0000000000400000-0x0000000000412000-memory.dmp
Size 72KB
Sample230301-jsfdpafc63
SHA256 eaa225b80741b70609cc75b4ab18c7f8f1c28679cb2540ea69efc89d46ef7bf2
MD5 978b3cf4dc6483cb1cdf26fa75bc1486
SHA1 c42ec4fe53bee86b1559dbde55691114a0c67b90
SHA512 f54a0d2626a7081d249172ea81f2d1c5f0b21a18327984dfb0660a17e94da9b89f511ebed1194e733744e03688a94f0aa15087de642b3414ebdf847cf645a977
SSDEEP 768:Pu/6ZTgoiziWUUM9rmo2qr8CqOmtoPI1zjbsgX3ic5m37K1YMKnBDZ:Pu/6ZTgle2dGG13bjXSQgd
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

rat default asyncrat

Malware Config

Extracted

Family

asyncrat

Version

0.5.7B

Botnet

Default

C2

morelogs22.sytes.net:20

Mutex

AsyncMutex_6SI8OkPnk

Attributes

delay
3
install
false
install_folder
%AppData%

aes.plain

Signatures

Async RAT payload 1 IoCs

rat

resource	yara_rule
sample	asyncrat

Asyncrat family
asyncrat

File Explorer

1728-70-0x0000000000400000-0x0000000000412000-memory.dmp

.exe 72KB

1728-70-0x0000000000400000-0x0000000000412000-memory.dmp

SHA256 eaa225b80741b70609cc75b4ab18c7f8f1c28679cb2540ea69efc89d46ef7bf2
MD5 978b3cf4dc6483cb1cdf26fa75bc1486
SHA1 c42ec4fe53bee86b1559dbde55691114a0c67b90
SHA512 f54a0d2626a7081d249172ea81f2d1c5f0b21a18327984dfb0660a17e94da9b89f511ebed1194e733744e03688a94f0aa15087de642b3414ebdf847cf645a977
SSDEEP 768:Pu/6ZTgoiziWUUM9rmo2qr8CqOmtoPI1zjbsgX3ic5m37K1YMKnBDZ:Pu/6ZTgle2dGG13bjXSQgd
MD5 SHA1 SHA512 SSDEEP

windows x86

Async RAT payload

rat

Minor OS version

Major OS version

Entry point

51006

Magic Number

267

Subsystem

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

Sharing