asyncrat | 0x000300000002287f-434[.]dat | Triage

Sharing

Copy URL Twitter E-mail

General

Target

0x000300000002287f-434.dat
Size

63KB
MD5

2d7e104a199600d550879e132d877ee7
SHA1

9a702148bcb48c8f666d275b0b08bf2b1711e069
SHA256

4f4432ddc88c1bca9f139589c8ce1fcaf016ff167d189e6fb6231057fdf1fff7
SHA512

c78a6954104da75ffb6a98447fe36f8297d27929a1eab540eed67e4ec42d35ad46fe0037bf29d7904f36433dce34a27b92556e4e376ef79c1914cc54676adc33
SSDEEP

768:a3lDmSRCvHxiP7VIiz9JS8cwoLw9Qq2R1+KASmv7mqb2nFpwH1ovTGU6eLMnqGzl:acHWRbc78du1ibb2w+3bdGztpqKmY7

Score

10^/10

rat default asyncrat

Malware Config

Extracted

Family

asyncrat

Version

CYB3R R4T 1.0.7

Botnet

Default

C2

ii-usd.at.ply.gg:25036

Mutex

Cyb3r_R4tMutex_Cyb3rw4rrior1011

Attributes

delay
1
install
true
install_file
syscall.exe
install_folder
%AppData%

aes.plain

Signatures

Async RAT payload 1 IoCs

resource	yara_rule
sample	asyncrat

Asyncrat family
asyncrat

Files

0x000300000002287f-434.dat
.exe windows x86

f34d5f2d4577ed6d9ceec516c1f5a744

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE

Imports

mscoree

_CorExeMain

Sections

.text
Size: 58KB - Virtual size: 58KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 3KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ