asyncrat | 0x000300000002287f-434[.]dat

General

Target
0x000300000002287f-434.dat
Size 63KB
Sample230319-sv716aba4w
SHA256 4f4432ddc88c1bca9f139589c8ce1fcaf016ff167d189e6fb6231057fdf1fff7
MD5 2d7e104a199600d550879e132d877ee7
SHA1 9a702148bcb48c8f666d275b0b08bf2b1711e069
SHA512 c78a6954104da75ffb6a98447fe36f8297d27929a1eab540eed67e4ec42d35ad46fe0037bf29d7904f36433dce34a27b92556e4e376ef79c1914cc54676adc33
SSDEEP 768:a3lDmSRCvHxiP7VIiz9JS8cwoLw9Qq2R1+KASmv7mqb2nFpwH1ovTGU6eLMnqGzl:acHWRbc78du1ibb2w+3bdGztpqKmY7
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

rat default asyncrat

Malware Config

Extracted

Family

asyncrat

Version

CYB3R R4T 1.0.7

Botnet

Default

C2

ii-usd.at.ply.gg:25036

Mutex

Cyb3r_R4tMutex_Cyb3rw4rrior1011

Attributes

delay
1
install
true
install_file
syscall.exe
install_folder
%AppData%

aes.plain

Signatures

Async RAT payload 1 IoCs

rat

resource	yara_rule
sample	asyncrat

Asyncrat family
asyncrat

File Explorer

0x000300000002287f-434.dat

.exe 63KB

0x000300000002287f-434.dat

IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
SHA256 4f4432ddc88c1bca9f139589c8ce1fcaf016ff167d189e6fb6231057fdf1fff7
MD5 2d7e104a199600d550879e132d877ee7
SHA1 9a702148bcb48c8f666d275b0b08bf2b1711e069
SHA512 c78a6954104da75ffb6a98447fe36f8297d27929a1eab540eed67e4ec42d35ad46fe0037bf29d7904f36433dce34a27b92556e4e376ef79c1914cc54676adc33
SSDEEP 768:a3lDmSRCvHxiP7VIiz9JS8cwoLw9Qq2R1+KASmv7mqb2nFpwH1ovTGU6eLMnqGzl:acHWRbc78du1ibb2w+3bdGztpqKmY7
MD5 SHA1 SHA512 SSDEEP

windows x86

Async RAT payload

rat

Minor OS version

Major OS version

Entry point

68078

Magic Number

267

Subsystem

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE

PDB paths

Sharing