Behavioral task
behavioral1
Sample
9473eebd3002fe8e81329dff2e255a43a7428c5636549c3b5552dbc70d14752f.exe
Resource
win7-20230220-en
General
-
Target
1c04b00aab7df87b70dfec96b5e182a1.bin
-
Size
32KB
-
MD5
06d281987111c7f1f64248cf11738534
-
SHA1
cfc552231d97d79882860e3fb33127305904b7ee
-
SHA256
5fe3cd4ee782cf43a5f3da2ca4478489d25fe40e0acb96f5a07078d7e532acb1
-
SHA512
960a7b0bdbeb16de16fca18bd3ed39736fd16e1006638d7952b27e045ddbb9fc4652586e827339c32e88680fd655d66bc82aa47155d83bb933052110897fe1e6
-
SSDEEP
768:Mw4+VsjwkaBHdM9xwdU4CapJ1ZwKhFnkvkW7w:LHmjurM9qUupJsIn7WM
Malware Config
Extracted
asyncrat
| Edit 3LOSH RAT
Default
84.54.50.9:6606
84.54.50.9:7707
84.54.50.9:8808
AsyncMutex_6SI8OkPnk
-
delay
3
-
install
false
-
install_folder
%AppData%
Signatures
-
Async RAT payload 1 IoCs
Processes:
resource yara_rule static1/unpack001/9473eebd3002fe8e81329dff2e255a43a7428c5636549c3b5552dbc70d14752f.exe asyncrat -
Asyncrat family
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
Processes:
resource unpack001/9473eebd3002fe8e81329dff2e255a43a7428c5636549c3b5552dbc70d14752f.exe
Files
-
1c04b00aab7df87b70dfec96b5e182a1.bin.zip
Password: infected
-
9473eebd3002fe8e81329dff2e255a43a7428c5636549c3b5552dbc70d14752f.exe.exe windows x86
Password: infected
f34d5f2d4577ed6d9ceec516c1f5a744
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
mscoree
_CorExeMain
Sections
.text Size: 63KB - Virtual size: 62KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 2KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ