asyncrat | bOPj[.]exe

General

Target
bOPj.exe
Size 47KB
Sample230811-shvv3aeb65
SHA256 61be8cdec38d60d5a8a64fd0f891656f0410825d7c1181d7f40eb6aaf56d3521
MD5 230cc963bf4ec456800d4c97bb9ed75f
SHA1 7cf46eaea8f922ad24f6ec70b4f8dd2024657329
SHA512 8925014159b3fc971172468a61d5cf7ef480c579685dedd9437b2b3a4ea35f5ab405ef0a9dcd8f88570446a26470b32bf7ea9694f5554b98c9791d8cf222a01a
SSDEEP 768:Eq+s3pUtDILNCCa+DiPsMmaCVi/G8YbNgeiMRDz1+KCfvEgK/JDZVc6KN:Eq+AGtQOWZzzbaXAoPnkJDZVclN
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

rat lindo asyncrat

Malware Config

Extracted

Family

asyncrat

Version

1.0.7

Botnet

LINDO

C2

2riandcra.duckdns.org:7575

Mutex

DcRatMutex_qwqdanchun

Attributes

delay
1
install
false
install_folder
%AppData%

aes.plain

Signatures

Async RAT payload 1 IoCs

rat

resource	yara_rule
sample	asyncrat

Asyncrat family
asyncrat

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
bOPj.exe

File Explorer

bOPj.exe

.exe 47KB

bOPj.exe

IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
SHA256 61be8cdec38d60d5a8a64fd0f891656f0410825d7c1181d7f40eb6aaf56d3521
MD5 230cc963bf4ec456800d4c97bb9ed75f
SHA1 7cf46eaea8f922ad24f6ec70b4f8dd2024657329
SHA512 8925014159b3fc971172468a61d5cf7ef480c579685dedd9437b2b3a4ea35f5ab405ef0a9dcd8f88570446a26470b32bf7ea9694f5554b98c9791d8cf222a01a
SSDEEP 768:Eq+s3pUtDILNCCa+DiPsMmaCVi/G8YbNgeiMRDz1+KCfvEgK/JDZVc6KN:Eq+AGtQOWZzzbaXAoPnkJDZVclN
MD5 SHA1 SHA512 SSDEEP

windows x86

Async RAT payload

rat
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

52158

Magic Number

267

Subsystem

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE

PDB paths

Sharing