Behavioral task
behavioral1
Sample
db9f7c6eb6c788a0d6707102f4bd022b565d3c3cdbb05512e70a6d687fa903c4.exe
Resource
win7-20230621-en
General
-
Target
eed2862c4cb15255e3c793cca.bin
-
Size
32KB
-
MD5
f9d8548c0812307f834d84bfd6640b6b
-
SHA1
fab1b4b16542d76f793ceee8eec96df86c377a7b
-
SHA256
bdc586c1d4d85861d7949cd8c8fabb27c819d294845490277e517ff4f765334f
-
SHA512
8090adff68d8f5c7ce806a72731687bb9ecca0d43311cf04354603636f4eaea35533d56dff2cc9644a4064b98fce15d83f19144b436f79e00e5cfa5664066281
-
SSDEEP
768:QVxf6je4B8Xe+HSeHXESqLkiNqbVkMbn2bdC3R1:QVxfGGes2nNqbhbnwA3R1
Malware Config
Extracted
asyncrat
| Edit 3LOSH RAT
junio 27
moneymaker.dynuddns.net:5757
AsyncMutex_6SI8OkPnk
-
delay
3
-
install
false
-
install_folder
%AppData%
Signatures
-
Async RAT payload 1 IoCs
resource yara_rule static1/unpack001/db9f7c6eb6c788a0d6707102f4bd022b565d3c3cdbb05512e70a6d687fa903c4.exe asyncrat -
Asyncrat family
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource unpack001/db9f7c6eb6c788a0d6707102f4bd022b565d3c3cdbb05512e70a6d687fa903c4.exe
Files
-
eed2862c4cb15255e3c793cca.bin.zip
Password: infected
-
db9f7c6eb6c788a0d6707102f4bd022b565d3c3cdbb05512e70a6d687fa903c4.exe.exe windows x86
f34d5f2d4577ed6d9ceec516c1f5a744
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
mscoree
_CorExeMain
Sections
.text Size: 63KB - Virtual size: 62KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 2KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ