asyncrat | tmp

General

Target

tmp
Size

586KB
MD5

ee66f2bfad8e166bbf329d4ef1f93707
SHA1

4bd6fbb645d7403eb9896b58b902ea4d7b87c2e5
SHA256

189c498922d89bd8257d152d63315956060667eeb8b5b327db19cc3c802ee23f
SHA512

b3b883d5ccf8468d09ea2ebab026a39246874eb0039654a5df419ed6219bf65569ffaad3a7e5d2b7db54d1d9200c3c12e19ee639469239ef51a95443e52091e8
SSDEEP

12288:4vvA21t1NRXXh63S+1s9/OGzKqSp9l05beI:o1XI/W/hGqS5YbeI

Score

10^/10

rat default asyncrat

Malware Config

Extracted

Family

asyncrat

Version

0.8.9C

Botnet

Default

C2

45.155.124.149:9999

Mutex

MTXVP_4296930478543

Attributes

delay
3
install
false
install_folder
%AppData%

aes.plain

Signatures

Async RAT payload 1 IoCs

rat

resource	yara_rule
sample	asyncrat

Asyncrat family
asyncrat

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
tmp

Files

tmp
.exe windows:4 windows x86

f34d5f2d4577ed6d9ceec516c1f5a744

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

mscoree

_CorExeMain

Sections

.text
Size: 583KB - Virtual size: 582KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Extracted

Signatures

Files

f34d5f2d4577ed6d9ceec516c1f5a744

Headers

DLL Characteristics

File Characteristics

Imports

mscoree

Sections

.text Size: 583KB - Virtual size: 582KB

.rsrc Size: 2KB - Virtual size: 1KB

.reloc Size: 512B - Virtual size: 12B

.text
Size: 583KB - Virtual size: 582KB

.rsrc
Size: 2KB - Virtual size: 1KB

.reloc
Size: 512B - Virtual size: 12B