General

  • Target

    async_modified_0.zip

  • Size

    32.2MB

  • MD5

    489518b14412de03373efb0f6748c10d

  • SHA1

    79407cb3ef838c74fed7af8ae2a15343a8061170

  • SHA256

    e00de00f1dd4187b6bd9e863ffcc29ca4101feb0ef1906e0f01864533244e3de

  • SHA512

    2e70cac4acba1f1ac20906463b82956ccf6c8ed6af59abd94251f697ae5decd0ffbe6d116b8ebb02d26388dfefdcec967fa3988be75fd9fc78a45f93c049b8be

  • SSDEEP

    786432:G3B7Da83uoAOcbRRnMNHXUGrbFiuRrjqJgzS5VamIwsdzl09u/MWUApGa:GR7DaOuoLORRMdXUGrbssGJQUIwsF/9B

Score
10/10

Malware Config

Signatures

  • Async RAT payload 13 IoCs
  • Asyncrat family
  • Contains code to disable Windows Defender 1 IoCs

    A .NET executable tasked with disabling Windows Defender capabilities such as realtime monitoring, blocking at first seen, etc.

  • Nirsoft 3 IoCs
  • NirSoft WebBrowserPassView 2 IoCs

    Password recovery tool for various web browsers

  • .NET Reactor proctector 1 IoCs

    Detects an executable protected by an unregistered version of Eziriz's .NET Reactor.

  • Unsigned PE 34 IoCs

    Checks for missing Authenticode signature.

Files

  • async_modified_0.zip
    .zip
  • async_modified/AsyncRAT.exe
    .exe windows x86

    f34d5f2d4577ed6d9ceec516c1f5a744


    Headers

    Imports

    Sections

  • async_modified/AsyncRAT.exe.config
    .xml
  • async_modified/BackProxyUI.exe
    .exe windows x86

    f34d5f2d4577ed6d9ceec516c1f5a744


    Headers

    Imports

    Sections

  • async_modified/BackProxyUI.exe.config
    .xml
  • async_modified/BackProxyUI.pdb
  • async_modified/BackupCertificate.zip
    .zip
  • async_modified/FastColoredTextBox.xml
    .xml
  • async_modified/Fixer.bat
  • async_modified/Loader.exe
    .exe windows x86

    a9c887a4f18a3fede2cc29ceea138ed3


    Headers

    Imports

    Sections

  • async_modified/Plugins/AVRemoval.dll
    .dll windows x86

    dae02f32a21e03ce65412f6e56942daa


    Headers

    Imports

    Sections

  • async_modified/Plugins/All-In-One.dll
    .dll windows x86

    dae02f32a21e03ce65412f6e56942daa


    Headers

    Imports

    Sections

  • async_modified/Plugins/AnyDesk.exe
    .exe windows x86


    Code Sign

    Headers

    Sections

  • async_modified/Plugins/Chat.dll
    .dll windows x86

    dae02f32a21e03ce65412f6e56942daa


    Headers

    Imports

    Sections

  • async_modified/Plugins/ChromiumCookies.dll
    .dll windows x86

    dae02f32a21e03ce65412f6e56942daa


    Headers

    Imports

    Sections

  • async_modified/Plugins/ChromiumCookies.pdb
  • async_modified/Plugins/DicordTokens.dll
    .dll windows x86

    dae02f32a21e03ce65412f6e56942daa


    Headers

    Imports

    Sections

  • async_modified/Plugins/DotNetZip.dll
    .dll windows x86

    dae02f32a21e03ce65412f6e56942daa


    Headers

    Imports

    Sections

  • async_modified/Plugins/Extra.dll
    .dll windows x86

    dae02f32a21e03ce65412f6e56942daa


    Headers

    Imports

    Sections

  • async_modified/Plugins/FPLCookies.dll
    .dll windows x86

    dae02f32a21e03ce65412f6e56942daa


    Headers

    Imports

    Sections

  • async_modified/Plugins/FPLCookies.pdb
  • async_modified/Plugins/FPLCookies.xml
  • async_modified/Plugins/FileManager.dll
    .dll windows x86

    dae02f32a21e03ce65412f6e56942daa


    Headers

    Imports

    Sections

  • async_modified/Plugins/FileSearcher.dll
    .dll windows x86

    dae02f32a21e03ce65412f6e56942daa


    Headers

    Imports

    Sections

  • async_modified/Plugins/Getscreen.dll
    .dll windows x86

    dae02f32a21e03ce65412f6e56942daa


    Headers

    Imports

    Sections

  • async_modified/Plugins/Hidden Anydesk.dll
    .dll windows x86

    dae02f32a21e03ce65412f6e56942daa


    Headers

    Imports

    Sections

  • async_modified/Plugins/LimeLogger.dll
    .dll windows x86

    dae02f32a21e03ce65412f6e56942daa


    Headers

    Imports

    Sections

  • async_modified/Plugins/Miscellaneous.dll
    .dll windows x86

    dae02f32a21e03ce65412f6e56942daa


    Headers

    Imports

    Sections

  • async_modified/Plugins/Net35.dll
    .dll windows x86

    dae02f32a21e03ce65412f6e56942daa


    Headers

    Imports

    Sections

  • async_modified/Plugins/Newtonsoft.Json.xml
    .xml
  • async_modified/Plugins/Options.dll
    .dll windows x86

    dae02f32a21e03ce65412f6e56942daa


    Headers

    Imports

    Sections

  • async_modified/Plugins/ProcessManager.dll
    .dll windows x86

    dae02f32a21e03ce65412f6e56942daa


    Headers

    Imports

    Sections

  • async_modified/Plugins/Recovery.dll
    .dll windows x86

    dae02f32a21e03ce65412f6e56942daa


    Headers

    Imports

    Sections

  • async_modified/Plugins/RemoteCamera.dll
    .dll windows x86

    dae02f32a21e03ce65412f6e56942daa


    Headers

    Imports

    Sections

  • async_modified/Plugins/RemoteDesktop.dll
    .dll windows x86

    dae02f32a21e03ce65412f6e56942daa


    Headers

    Imports

    Sections

  • async_modified/Plugins/SQLite.Interop.dll
    .dll windows x86

    43cf4064308c8cffa2acc646c51eabf0


    Headers

    Imports

    Exports

    Sections

  • async_modified/Plugins/SendFile.dll
    .dll windows x86

    dae02f32a21e03ce65412f6e56942daa


    Headers

    Imports

    Sections

  • async_modified/Plugins/SendMemory.dll
    .dll windows x86

    dae02f32a21e03ce65412f6e56942daa


    Headers

    Imports

    Sections

  • async_modified/Plugins/System.Data.SQLite.dll.config
    .xml
  • async_modified/Plugins/System.Data.SQLite.xml
    .xml .js
  • async_modified/Plugins/System.IO.Compression.FileSystem.xml
  • async_modified/Plugins/UACOFF.dll
    .dll windows x86

    dae02f32a21e03ce65412f6e56942daa


    Headers

    Imports

    Sections

  • async_modified/Plugins/WDExclusion.dll
    .dll windows x86

    dae02f32a21e03ce65412f6e56942daa


    Headers

    Imports

    Sections

  • async_modified/Plugins/Wallets.dll
    .dll windows x86

    dae02f32a21e03ce65412f6e56942daa


    Headers

    Imports

    Sections

  • async_modified/Plugins/WebBrowserPass.dll
    .dll windows x86

    dae02f32a21e03ce65412f6e56942daa


    Headers

    Imports

    Sections

  • async_modified/Plugins/desktop.ini
  • async_modified/Plugins/symbols.map
  • async_modified/Plugins/x64/SQLite.Interop.dll
    .dll windows x64

    6f6d0bdadb839e140d7a41e8d1e05c22


    Headers

    Imports

    Exports

    Sections

  • async_modified/Plugins/x86/SQLite.Interop.dll
    .dll windows x86

    43cf4064308c8cffa2acc646c51eabf0


    Headers

    Imports

    Exports

    Sections

  • async_modified/ServerCertificate.p12
  • async_modified/Stub/Stub.exe
    .exe windows x86

    f34d5f2d4577ed6d9ceec516c1f5a744


    Headers

    Imports

    Sections

  • async_modified/Stub/Stub.exe.config
    .xml
  • async_modified/Vestris.ResourceLib.xml
    .xml
  • async_modified/dnlib.xml
    .xml
  • async_modified/proxlib.dll
    .dll windows x86

    fef8ddc2ebd24bd94fe8bc7869611463


    Headers

    Imports

    Exports

    Sections