Static

static

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    AATrilogyPatcher.exe

  • Size

    158.6MB

  • MD5

    77912d5ae6eb5f8aa489241637c2ec79

  • SHA1

    db51543f0d59f2f5f04642325d9ea55f839ed398

  • SHA256

    c6bec06b9ec0551e4787fb7dadcb1cd4a314cb25fe6a2b475addde0f12ae1f44

  • SHA512

    9fb154063317321183b9a7330102ef946f5c03c29dbf4676923dec8d7710557aea9632c8ee115a01deb5ee013822c6da661a7d7c9d7c4ef894095c783ce7487f

  • SSDEEP

    1572864:av4ksPQB6uw5GS2i5jEBkqYnIgJM0cAZV7SG2AcA6898ygNQvoL0uVMLGp7WDDNQ:U9B6VJr1ukO+chfSVjp8NzjPyZMG58

Score
10/10
ratcoreentityasyncrat

Malware Config

Signatures

  • Async RAT payload 1 IoCs
    rat
  • Asyncrat family
    asyncrat
  • CoreEntity .NET Packer 1 IoCs

    A .NET packer called CoreEntity where it has embedded the payload as a BitMap object which is later decrypted.

    coreentity
  • Unsigned PE 1 IoCs

    Checks for missing Authenticode signature.

Files

  • AATrilogyPatcher.exe
    .exe windows x86

    34dc34e244a6f4378a06076ff16fc082


    Headers

    Imports

    Exports

    Sections