Overview

overview

10

Static

static

10

1300-41-0x...ry.exe

windows7-x64

1300-41-0x...ry.exe

windows10-2004-x64

Sharing

Copy URL Twitter E-mail

General

  • Target

    1300-41-0x0000000000400000-0x0000000000412000-memory.dmp

  • Size

    72KB

  • MD5

    890b33ffd4927162a4a443024fd280f5

  • SHA1

    fe6ca9492bd75de832a2d4f4557b8a774ff18690

  • SHA256

    eccff48b28a17244476ec22ab833185a118d5bcdd41067157931098da79ede47

  • SHA512

    599d771a045044170e4954032976ee6c3e71103be1ae6e94bc535b2802ab821ee08ac19532faa6e451e4fb0501045f41d80211712cc5b259e97fb92a83ce7dc0

  • SSDEEP

    1536:fuQCNTR+J2Ig646npXw3bfjSSHFpAE10b23PPrdHx:fuQGTR+J2IH4CXw3bfrFpAS/PrFx

Score
10/10
ratdefaultasyncrat

Malware Config

Extracted

Family

asyncrat

Version

0.5.7B

Botnet

Default

C2

flitryuzoneu.zapto.org:7708

flitryuzoneu.zapto.org:8008

flitryuzoneu.zapto.org:9909

dlitryuzoneu.sytes.net:7708

dlitryuzoneu.sytes.net:8008

dlitryuzoneu.sytes.net:9909
Mutex

AsyncMutex_6SI8OkPsk

Attributes
  • delay

    3

  • install

    true

  • install_file

    crvs.exe

  • install_folder

    %AppData%

aes.plain

Signatures

  • Async RAT payload 1 IoCs
    rat
  • Asyncrat family
    asyncrat
  • Unsigned PE 1 IoCs

    Checks for missing Authenticode signature.

Files

  • 1300-41-0x0000000000400000-0x0000000000412000-memory.dmp
    .exe windows:4 windows x86


    Headers

    Sections