Behavioral task
behavioral1
Sample
stub.exe
Resource
win7-20230220-en
General
-
Target
stub.exe
-
Size
66KB
-
MD5
c8023bd8964abb39792742753fb3f4c5
-
SHA1
d46f3869b0f4eea095d453df11d1d028a881eb3e
-
SHA256
ba2fa518d6f9cf092b4a0e9714e15dc1e90b1e9da2bb029e362979c1882bfc38
-
SHA512
cf5314205757b9fbe98631714e0eba76315a62d12305a4e6456f79948020f8ab32650d100b4ba2dde7200bf362cd0a6e113afd0d24473e3f334340b8b5da69c0
-
SSDEEP
1536:3mcmJ6tXpkNzhN+cQxo2VAJR2Yoc4sKu+UYF8Hjqp7LPsbC31JkG5rCrCZx:3mJJ6tZkNdKu+UYFVp/0bC3YK4+x
Malware Config
Extracted
asyncrat
| Edit 3LOSH RAT
kr_B
krnewfine.work.gd:6666
nasori.ddnsfree.com:6666
AsyncMutex_xxx3x33342
-
delay
3
-
install
false
-
install_folder
%AppData%
Files
-
stub.exe.exe windows x86
f34d5f2d4577ed6d9ceec516c1f5a744
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
mscoree
_CorExeMain
Sections
.text Size: 63KB - Virtual size: 62KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 2KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ