asyncrat | ClientAny[.]exe | Triage

Sharing

Copy URL Twitter E-mail

General

Target

ClientAny.exe
Size

71KB
MD5

479b8a2ff0ff15a9c6e870e5c7d4cb97
SHA1

4727916dc9952255d1174ae2602b8cb192180f53
SHA256

1520fb559bb411b43702bbeae3b66ed30eff91ffa3b1910993df4b2be8748df8
SHA512

88c1125357d8f9abfa393d4578249709cb58d52fd03302d2748b09ab3d87c4fc8895c067f76f35d653e0dd6f6bbc8105277b40e401ebbbe9756dd39c0e0c6d70
SSDEEP

1536:Tm1Aj6Sr6ZfN+WJWCPrAS8EB91bBRzQ/7dxLVclN:6VSr6ZfN+WoCjASD91bB9Q/bBY

Score

10^/10

rat asyncrat

Malware Config

Signatures

Async RAT payload 1 IoCs

resource	yara_rule
sample	asyncrat

Asyncrat family
asyncrat

Files

ClientAny.exe
.exe windows x86

f34d5f2d4577ed6d9ceec516c1f5a744

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE

Imports

mscoree

_CorExeMain

Sections

.text
Size: 66KB - Virtual size: 66KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 3KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ