Overview

overview

10

Static

static

10

xIsLPxI68jk0.exe

windows7-x64

10

xIsLPxI68jk0.exe

windows10-2004-x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target

    xIsLPxI68jk0.exe

  • Size

    47KB

  • MD5

    81e7f516f000360070fcabddaa843975

  • SHA1

    75133bc960f4536afdc3c019664903541f7d7c7f

  • SHA256

    df7a8962331cc5a23cd13744420aa91547cfc085950d22ab1b7e4f298b2ee0ab

  • SHA512

    97b55be21d05ed626914590c8514cd464d5f2043d93b052fc101b3347d67a2832e3fc6ee3d8b480163725bc33fcdbf5e49bef4d7077be48a88e69d4affd21cfd

  • SSDEEP

    768:gq+s3pUtDILNCCa+Di029oui41Ybage+buiKvEgK/JHZVc6KN:gq+AGtQOx9VubNcPnkJHZVclN

Score
10/10
rat2-rian asyncrat

Malware Config

Extracted

Family

asyncrat

Version

1.0.7

Botnet

2-RIAN

C2

promotores14.duckdns.org:2356

Mutex

DcRatMutex_qwqdanchun

Attributes
  • delay

    1

  • install

    false

  • install_folder

    %AppData%

aes.plain

Signatures

  • Async RAT payload 1 IoCs
    rat
  • Asyncrat family
    asyncrat
  • Unsigned PE 1 IoCs

    Checks for missing Authenticode signature.

Files

  • xIsLPxI68jk0.exe
    .exe windows x86

    f34d5f2d4577ed6d9ceec516c1f5a744


    Headers

    Imports

    Sections