Overview

overview

10

Static

static

10

2556-58-0x...ry.exe

windows7-x64

10

2556-58-0x...ry.exe

windows10-2004-x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target

    2556-58-0x0000000000560000-0x0000000000578000-memory.dmp

  • Size

    96KB

  • MD5

    85d366333a62a7ed79158559e13ede72

  • SHA1

    0ec586f0faf3f125267073609789317a54563dfa

  • SHA256

    3f0415d5ea5eb25dfb2c283b005ea0c549ae95f750a8a02711524e05a87cc37d

  • SHA512

    d1fab6676ca040a0399b7a07342bbb7ebb5f9f427a0b257ee4f32305e19e82642387f5f8fd5fa385f45abb1f49777592199e312f538231d5aed8eb4e70b2c325

  • SSDEEP

    1536:fUyKcxARXOd9z9QAWrIZH1bl/BoBk7zLLVclN:fU5cxAFoZ99vH1bl2Bk7BY

Score
10/10
ratdefaultasyncrat

Malware Config

Extracted

Family

asyncrat

Botnet

Default

Mutex

ebdxnqyokry

Attributes
  • delay

    11

  • install

    true

  • install_file

    wps.exe

  • install_folder

    %AppData%

  • pastebin_config

    https://pastebin.com/raw/YUtN6HEu

aes.plain

Signatures

  • Async RAT payload 1 IoCs
    rat
  • Asyncrat family
    asyncrat
  • Unsigned PE 1 IoCs

    Checks for missing Authenticode signature.

Files

  • 2556-58-0x0000000000560000-0x0000000000578000-memory.dmp
    .exe windows x86

    f34d5f2d4577ed6d9ceec516c1f5a744


    Headers

    Imports

    Sections