asyncrat | NEAS[.]c319f3ba4499c8c6cd9f32cd9af196d0[.]exe | Triage

Sharing

Copy URL Twitter E-mail

General

Target

NEAS.c319f3ba4499c8c6cd9f32cd9af196d0.exe
Size

1.3MB
MD5

c319f3ba4499c8c6cd9f32cd9af196d0
SHA1

8d4db227646079ba46220a574d80d5b649b4220f
SHA256

e02f814f2933d102569dfe96f4558650b9186e24ab7b20e8eeeccdf089713a4e
SHA512

b91cd2fed002291f2e9e25a0f87cf5d5e5f9ccfad3e476c018de641a9108ae8a323df796cff0503215ea9d66b78443d5dc7baf0e737cd145aefb384738680720
SSDEEP

24576:v27dq+fYDkDrXB+vxalxTm8tA5FOQ9E5JR/VZQDagQMqQS2/rB9vSbV:v27dqFk/Q0RRwYa2RtEagaQS2/99qV

Score

10^/10

rat asyncrat

Malware Config

Signatures

Async RAT payload 1 IoCs

resource	yara_rule
sample	asyncrat

Asyncrat family
asyncrat

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
NEAS.c319f3ba4499c8c6cd9f32cd9af196d0.exe

Files

NEAS.c319f3ba4499c8c6cd9f32cd9af196d0.exe
.exe windows:4 windows x64

0333fa48d7eea8f099bbdbe517194ab7

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Imports

iphlpapi

GetInterfaceInfo

msvcrt

_wcsnicmp

psapi

GetMappedFileNameW

kernel32

Sleep

user32

GetWindow

advapi32

RegSetValueExA

shell32

SHGetFolderPathW

Sections

.text
Size: 72KB - Virtual size: 72KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.sedata
Size: 1.2MB - Virtual size: 1.2MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 1024B - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 3KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.sedata
Size: 8KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ