asyncrat | stub[.]exe

General

Target
stub.exe
Size 66KB
Sample230424-ws2cdafd5v
SHA256 fb11be4f9b79350a9b1e70ef3e835d0c066f15ea84424bc639e0fc70227d05a3
MD5 82939ee2605a46e68018d5b075ef8e7a
SHA1 6579b9eb62650df681b9ddc870d1012d23b85b09
SHA512 2eb55b7c6a92bae97c2399fc446ad0556e885290f9968d5405187d8c1bd6137db31c30cbfda8360206cb92246d0a50bd35f7585a2cd6d50a526ea40b335055d5
SSDEEP 1536:v2UukvF1tkk/hEYRo2NQphePvUgcKu5UYF5KzUWudRj5sjsjObUu/+tfPQNnr/rR:v2JkvF1tkXKu5UYF5KzhuDj5sjIObUlE
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

rat default asyncrat

Malware Config

Extracted

Family

asyncrat

Version

| Edit 3LOSH RAT

Botnet

Default

C2

mikedonohue.kozow.com:30305

Mutex

AsyncMutex_6SI8OkPnk

Attributes

delay
3
install
false
install_folder
%AppData%

aes.plain

Signatures

Async RAT payload 1 IoCs

rat

resource	yara_rule
sample	asyncrat

Asyncrat family
asyncrat

File Explorer

stub.exe

.exe 66KB

stub.exe

IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
SHA256 fb11be4f9b79350a9b1e70ef3e835d0c066f15ea84424bc639e0fc70227d05a3
MD5 82939ee2605a46e68018d5b075ef8e7a
SHA1 6579b9eb62650df681b9ddc870d1012d23b85b09
SHA512 2eb55b7c6a92bae97c2399fc446ad0556e885290f9968d5405187d8c1bd6137db31c30cbfda8360206cb92246d0a50bd35f7585a2cd6d50a526ea40b335055d5
SSDEEP 1536:v2UukvF1tkk/hEYRo2NQphePvUgcKu5UYF5KzUWudRj5sjsjObUu/+tfPQNnr/rR:v2JkvF1tkXKu5UYF5KzhuDj5sjIObUlE
MD5 SHA1 SHA512 SSDEEP

windows x86

Async RAT payload

rat

Minor OS version

Major OS version

Entry point

72334

Magic Number

267

Subsystem

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

Sharing