asyncrat | Stub[.]exe

General

Target

Stub.exe
Size

47KB
MD5

6c99b4c4064fe2ba0f3506b6283a16fa
SHA1

08a9c6a87194d88999dddc3689b73bc4923e4e43
SHA256

eb37d95815824d94246220ac0bb63bce4ad8f9b3e821362d2d35867e9b83068c
SHA512

7d113e23bafd432ef8436e38c64ff12198db5b5cb547c02753e52e998a83deedbed36a46e4914f04fd70de76be69c41a440eeeffe903979bf62c5ca6aca93bef
SSDEEP

768:6u/6ZTgoiziWUUM9rmo2qrdkxZLbkxQ86PI+ag0b3M8S5v5FwVhFNXw3tE7bhv8+:6u/6ZTgle2e1xQ8D+Gbc8S50FNAd4dS8

Score

10^/10

rat aloshwsf5555 asyncrat

Malware Config

Extracted

Family

asyncrat

Version

0.5.7B

Botnet

AloshWSF5555

C2

microwsfp5555.ddns.net:5555

Mutex

AsyncMutex_6SI8OkPnk

Attributes

delay
3
install
false
install_folder
%AppData%

aes.plain

Signatures

Async RAT payload 1 IoCs

rat

resource	yara_rule
sample	asyncrat

Asyncrat family
asyncrat

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
Stub.exe

Files

Stub.exe
.exe windows:4 windows x86

f34d5f2d4577ed6d9ceec516c1f5a744

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

mscoree

_CorExeMain

Sections

.text
Size: 44KB - Virtual size: 44KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Extracted

Signatures

Files

f34d5f2d4577ed6d9ceec516c1f5a744

Headers

DLL Characteristics

File Characteristics

Imports

mscoree

Sections

.text Size: 44KB - Virtual size: 44KB

.rsrc Size: 2KB - Virtual size: 1KB

.reloc Size: 512B - Virtual size: 12B

.text
Size: 44KB - Virtual size: 44KB

.rsrc
Size: 2KB - Virtual size: 1KB

.reloc
Size: 512B - Virtual size: 12B