asyncrat | 8441ddb18dfbc80ddc5e814f2566ab54[.]exe | Triage

Sharing

General

Target

8441ddb18dfbc80ddc5e814f2566ab54.exe
Size

47KB
MD5

8441ddb18dfbc80ddc5e814f2566ab54
SHA1

e961dae02d49c649389241bb0043b9eb1908dfd1
SHA256

b32c3079004939613c101ecc860fa21101596f0c81ea0580882576293c63b31f
SHA512

cc0bff6220818bcaee9acdb353eba77867401f35ffe12823777ffed71e010d3f094de3814362c07c4e1d48e76d7cb5ac6e8f86b84ee991e3a5981c3a24653f4c
SSDEEP

768:1uwCfTg46YbWUn9jjmo2qrzaEOO2vIhwuKWrBYjlaxZ0bHd99P2VRCV2jFnSagZG:1uwCfTgpM2ogvIh/rBYhqebHdWPSjvdw

Score

10^/10

rat default asyncrat

Malware Config

Extracted

Family

asyncrat

Version

0.5.7B

Botnet

Default

C2

45.155.158.187:1337

Mutex

AsyncMutex_6SI8OkPnk

Attributes

delay
3
install
false
install_folder
%AppData%

aes.plain

Signatures

Async RAT payload 1 IoCs

resource	yara_rule
sample	asyncrat

Asyncrat family
asyncrat

Files

8441ddb18dfbc80ddc5e814f2566ab54.exe
.exe windows x86

f34d5f2d4577ed6d9ceec516c1f5a744

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

mscoree

_CorExeMain

Sections

.text
Size: 44KB - Virtual size: 44KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ