asyncrat | 0bc0c13a50fc831fd7218d4415696639[.]bin | Triage

Sharing

Copy URL Twitter E-mail

General

Target

0bc0c13a50fc831fd7218d4415696639.bin
Size

32KB
MD5

7665fc92d1a8d1ec395da0e1bb9ddf19
SHA1

b3e2b68f49b0c1f9c771d67a230c6708267aa607
SHA256

8f5be35085712c64de839459b24519638aa003edb3ec5638849ce3c2bf8eae51
SHA512

36e9b89d84db78ef11961b9b1c4699400d3f894aab25681355b37319caeeb9ab7db41e305114835d1c80561e889870694d1b3ca846ac0d14b195fcdb1f8e42fe
SSDEEP

768:DoxlW16OYyNvtZNyYOXTkM8JIds5XJ7L8ciRuTZ5ltgozK4crm82u:eQgOYiyYSkNIeb7L8RwTZ5Yoe4Mmvu

Score

10^/10

rat default asyncrat

Malware Config

Extracted

Family

asyncrat

Version

| Edit 3LOSH RAT

Botnet

Default

C2

officiallysoldtoprof.ddnsfree.com:5005

Mutex

AsyncMutex_6SI8OkPnk

Attributes

delay
3
install
false
install_folder
%AppData%

aes.plain

Signatures

Async RAT payload 1 IoCs

resource	yara_rule
static1/unpack001/26365f14a1d9634f9dcd8a4d5b19b23c1142abb7cc6c225c945732772ecbc7fa.exe	asyncrat

Asyncrat family
asyncrat

Files

0bc0c13a50fc831fd7218d4415696639.bin
.zip

Password: infected
26365f14a1d9634f9dcd8a4d5b19b23c1142abb7cc6c225c945732772ecbc7fa.exe
.exe windows x86

Password: infected

f34d5f2d4577ed6d9ceec516c1f5a744

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

mscoree

_CorExeMain

Sections

.text
Size: 63KB - Virtual size: 62KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ