Analysis
-
max time kernel
128s -
max time network
142s -
platform
windows7_x64 -
resource
win7-20230220-en -
resource tags
arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system -
submitted
05/06/2023, 14:56
Behavioral task
behavioral1
Sample
AsyncClient.exe
Resource
win7-20230220-en
3 signatures
150 seconds
General
-
Target
AsyncClient.exe
-
Size
45KB
-
MD5
201a8b53a4749fd4f6f768aa3b003b04
-
SHA1
c829d9e8030354c162d2ded4a1fe3f0b71f6c9e7
-
SHA256
b17fb441c2af8dd5b20e49ffb9766bc737c9b6557db31beb3d9d18309dc87aec
-
SHA512
e1346b63a5d57a72a410177ca1a52246dcb36be1a1da990a0d519a71781384e3c5712f4778674d219ee68421207f165286f003c9d3dd981678d85eb2336c5611
-
SSDEEP
768:ju0OVTBRlc6nWUbmelmo2qjrKjGKG6PIyzjbFgX3iXavcTaPBDZjx:ju0OVTBnck26KYDy3bCXSK4Odjx
Malware Config
Extracted
Family
asyncrat
Version
0.5.7B
Botnet
Default
C2
127.0.0.1:15491
127.0.0.1:8080
195.78.54.247:15491
195.78.54.247:8080
2.tcp.eu.ngrok.io:15491
2.tcp.eu.ngrok.io:8080
Mutex
AsyncMutex_6SI8OkPnk
Attributes
-
delay
3
-
install
false
-
install_file
awdawd.exe
-
install_folder
%AppData%
aes.plain
Signatures
-
Async RAT payload 1 IoCs
resource yara_rule behavioral1/memory/1324-54-0x0000000000F90000-0x0000000000FA2000-memory.dmp asyncrat -
Legitimate hosting services abused for malware hosting/C2 1 TTPs