Overview

overview

10

Static

static

10

bf55dee34a...ed.exe

windows7-x64

10

bf55dee34a...ed.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    bf55dee34ac140ac4f7d717900613fed.exe

  • Size

    62KB

  • MD5

    bf55dee34ac140ac4f7d717900613fed

  • SHA1

    5ece7fe6ab249b4396892cbb1800f75c62aa1d8b

  • SHA256

    bb858fda45f0ba2c5ef800bcc9f23424ce2d43ae4e202cbf3e293ae16089d4fc

  • SHA512

    2542e89716ee204e95270f2a7c502ccbc3d6b5a6546bb97f5a0ba4614bca2e5caca1e9458b6a01f0e34cb127b8892c4cd28779345b34005c8456f5f23116af54

  • SSDEEP

    1536:vHDTgTiogcF0aJb9eVyN3dp7b5pAtYZR4v7Sf+:vjTgTiogcGaJb9j3dJKcpm

Score
10/10
ratgrandrp bot iasyncrat

Malware Config

Extracted

Family

asyncrat

Version

true

Botnet

GrandRP Bot I

Mutex

RRAT_oMdrDYwqB

Attributes
  • delay

    3

  • install

    false

  • install_file

    powershell Add-MpPreference -ExclusionPath C:\

  • install_folder

    Explorer.exe

  • pastebin_config

    http://pastebin.com/raw/KKpnJShN

aes.plain

Signatures

  • Async RAT payload 1 IoCs
    rat
  • Asyncrat family
    asyncrat
  • Unsigned PE 1 IoCs

    Checks for missing Authenticode signature.

Files

  • bf55dee34ac140ac4f7d717900613fed.exe
    .exe windows:4 windows x86

    f34d5f2d4577ed6d9ceec516c1f5a744


    Headers

    Imports

    Sections