asyncrat | 3x[.]exe

General

Target

3x.exe
Size

48KB
MD5

44c47b26f1ac7367e1032daacf59d8c3
SHA1

b928283e739629b9676347b0491fee96109d7d9e
SHA256

254c69ff5a18c8726eb49eff6b164177a27c5f451ac3619c058794d677dd013a
SHA512

2a71bb185953887d7e16a83966e296bc4548b3012acf3f86b18884e89a3d47b059aef1586d332e73da614980c1585590e2150f55314ab0fa7806d0cbfaddd10a
SSDEEP

768:WiqvpILY+sU+LiaRyuZWi5Nx8YbCge/5IlWrUvEgK/JpFVc6KN:WiWMaIuzxzblcKorUnkJpFVclN

Score

10^/10

rat discord asyncrat

Malware Config

Extracted

Family

asyncrat

Version

1.0.7

Botnet

Discord

C2

tr2.localto.net:41520

Mutex

DcRatMutex_qwqdanchun

Attributes

delay
1
install
true
install_file
taskhostwt.exe
install_folder
%AppData%

aes.plain

Signatures

Async RAT payload 1 IoCs

rat

resource	yara_rule
sample	asyncrat

Asyncrat family
asyncrat

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
3x.exe

Files

3x.exe
.exe windows x86

f34d5f2d4577ed6d9ceec516c1f5a744

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE

Imports

mscoree

_CorExeMain

Sections

.text
Size: 43KB - Virtual size: 42KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Extracted

Signatures

Files

f34d5f2d4577ed6d9ceec516c1f5a744

Headers

DLL Characteristics

File Characteristics

Imports

mscoree

Sections

.text Size: 43KB - Virtual size: 42KB

.rsrc Size: 4KB - Virtual size: 3KB

.reloc Size: 512B - Virtual size: 12B

.text
Size: 43KB - Virtual size: 42KB

.rsrc
Size: 4KB - Virtual size: 3KB

.reloc
Size: 512B - Virtual size: 12B