Behavioral task
behavioral1
Sample
AsyncClient.exe
Resource
win7-20230712-en
General
-
Target
AsyncClient.exe
-
Size
45KB
-
MD5
d965c635ef596badfc6162969da79f14
-
SHA1
a577d42582fecd7ba93c42f25ed4e31c48f0ff4f
-
SHA256
6a5e172a5d6d726582dfffc40f5d6d9de97ccce97f1902cbdc106afe5ddd4b60
-
SHA512
cba1544a79fbeb44a5d71cb8fb7ba28470198c096cb71b6d739bb57014a54b44afba70d0df72ddb24485188e69080320f60493413b2cf46680254301474381b5
-
SSDEEP
768:3uypNTAoZjRWUJs9bmo2qL7KjGKG6PIyzjbFgX3i0FU+ZANY8yaXf0VkBDZzx:3uypNTAGo2WKYDy3bCXS0rZKX3dzx
Malware Config
Extracted
asyncrat
0.5.7B
Default
5.tcp.eu.ngrok.io:5403
5.tcp.eu.ngrok.io:19216
AsyncMutex_6SI8OkPnk
-
delay
3
-
install
false
-
install_file
svchost.exe
-
install_folder
%AppData%
Signatures
Files
-
AsyncClient.exe.exe windows x86
f34d5f2d4577ed6d9ceec516c1f5a744
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
mscoree
_CorExeMain
Sections
.text Size: 42KB - Virtual size: 41KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 2KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ