Overview

overview

10

Static

static

10

suspicious...AT.exe

windows7-x64

7

suspicious...AT.exe

windows10-2004-x64

7

suspicious...ip.dll

windows7-x64

1

suspicious...ip.dll

windows10-2004-x64

1

suspicious...ox.dll

windows7-x64

1

suspicious...ox.dll

windows10-2004-x64

1

suspicious...73.dll

windows7-x64

1

suspicious...73.dll

windows10-2004-x64

1

suspicious...I2.dll

windows7-x64

1

suspicious...I2.dll

windows10-2004-x64

1

suspicious...pf.dll

windows7-x64

1

suspicious...pf.dll

windows10-2004-x64

1

suspicious...ts.dll

windows7-x64

1

suspicious...ts.dll

windows10-2004-x64

1

suspicious...rk.dll

windows7-x64

1

suspicious...rk.dll

windows10-2004-x64

1

suspicious...on.dll

windows7-x64

1

suspicious...on.dll

windows10-2004-x64

1

suspicious...ws.dll

windows7-x64

1

suspicious...ws.dll

windows10-2004-x64

1

suspicious...in.dll

windows7-x64

1

suspicious...in.dll

windows10-2004-x64

1

suspicious...re.dll

windows7-x64

1

suspicious...re.dll

windows10-2004-x64

1

suspicious...io.dll

windows7-x64

1

suspicious...io.dll

windows10-2004-x64

1

suspicious...er.dll

windows7-x64

1

suspicious...er.dll

windows10-2004-x64

1

suspicious...at.dll

windows7-x64

1

suspicious...at.dll

windows10-2004-x64

1

suspicious...rd.dll

windows7-x64

1

suspicious...rd.dll

windows10-2004-x64

1

Sharing

Copy URL Twitter E-mail

General

  • Target

    suspicious #2.zip

  • Size

    51.2MB

  • MD5

    51c885e56df3732ed217e21f70f065fe

  • SHA1

    7d06eaa7c488e7c73b96c5cef4247ff390ea7046

  • SHA256

    0bdc1c6419fbf61e6125bdd6d5fe94ada127c091ae7d6e6d79c47662cc878b64

  • SHA512

    8ed532cf4b47b6a5a6c2adb0d6600f87264c9fbe2f3dacd4641ec2e04176a2bab2afc95d3209bf48a37b13187fba3f7e6c6ad0a09b3b743bb813ae74f7258a5c

  • SSDEEP

    786432:VJbQxRXfPm47crUSi9zVu5z7DwEO10fpkr7q842orOiiCgLLgoK6hoD1ePwMYyk/:/QxJPm4AbmhCzvUr+Fr7gg6gePjYSY3

Score
10/10
agilenetratasyncrat

Malware Config

Signatures

  • Async RAT payload 18 IoCs
    rat
  • Asyncrat family
    asyncrat
  • Obfuscated with Agile.Net obfuscator 1 IoCs

    Detects use of the Agile.Net commercial obfuscator, which is capable of entity renaming and control flow obfuscation.

    agilenet
  • Unsigned PE 49 IoCs

    Checks for missing Authenticode signature.

Files

  • suspicious #2.zip
    .zip
  • suspicious #2/._cache_S500RAT.exe
    .exe windows:4 windows x86 arch:x86

    f34d5f2d4577ed6d9ceec516c1f5a744


    Headers

    Imports

    Sections

  • suspicious #2/BouncyCastle.Crypto.dll
    .dll windows:4 windows x86 arch:x86

    dae02f32a21e03ce65412f6e56942daa


    Headers

    Imports

    Sections

  • suspicious #2/Certificate/BackupCertificate.zip
    .zip
  • ServerCertificate.p12
  • suspicious #2/Certificate/ServerCertificate.p12
  • suspicious #2/Chrome.ico
  • suspicious #2/Clients/Downloads/A82871D5B4CE1A95/1.DAT
  • suspicious #2/Clients/Downloads/A82871D5B4CE1A95/10.DAT
  • suspicious #2/Clients/Downloads/A82871D5B4CE1A95/11.DAT
  • suspicious #2/Clients/Downloads/A82871D5B4CE1A95/2.DAT
  • suspicious #2/Clients/Downloads/A82871D5B4CE1A95/5.DAT
  • suspicious #2/Clients/Downloads/A82871D5B4CE1A95/7.DAT
  • suspicious #2/Compression7zip.dll
    .dll windows:4 windows x86 arch:x86

    dae02f32a21e03ce65412f6e56942daa


    Headers

    Imports

    Sections

  • suspicious #2/FastColoredTextBox.dll
    .dll windows:4 windows x86 arch:x86

    dae02f32a21e03ce65412f6e56942daa


    Headers

    Imports

    Sections

  • suspicious #2/Gry73.dll
    .dll windows:4 windows x86 arch:x86

    dae02f32a21e03ce65412f6e56942daa


    Headers

    Imports

    Sections

  • suspicious #2/Guna.UI2.dll
    .dll windows:4 windows x86 arch:x86

    dae02f32a21e03ce65412f6e56942daa


    Code Sign

    Headers

    Imports

    Sections

  • suspicious #2/LiveCharts.Wpf.dll
    .dll windows:4 windows x86 arch:x86

    dae02f32a21e03ce65412f6e56942daa


    Headers

    Imports

    Sections

  • suspicious #2/LiveCharts.dll
    .dll windows:4 windows x86 arch:x86

    dae02f32a21e03ce65412f6e56942daa


    Headers

    Imports

    Sections

  • suspicious #2/Login.txt
  • suspicious #2/MetroFramework.dll
    .dll windows:4 windows x86 arch:x86

    dae02f32a21e03ce65412f6e56942daa


    Headers

    Imports

    Sections

  • suspicious #2/New Project 1.peu
  • suspicious #2/Obfuscation.dll
    .dll windows:4 windows x86 arch:x86

    dae02f32a21e03ce65412f6e56942daa


    Headers

    Imports

    Sections

  • suspicious #2/PLESAE READ ME.txt
  • suspicious #2/Plugins/ActiveWindows.dll
  • suspicious #2/Plugins/Admin.dll
  • suspicious #2/Plugins/AntiMalware.dll
  • suspicious #2/Plugins/Audio.dll
    .dll windows:4 windows x86 arch:x86

    dae02f32a21e03ce65412f6e56942daa


    Headers

    Imports

    Sections

  • suspicious #2/Plugins/BotsKiller.dll
  • suspicious #2/Plugins/Chat.dll
    .dll windows:4 windows x86 arch:x86

    dae02f32a21e03ce65412f6e56942daa


    Headers

    Imports

    Sections

  • suspicious #2/Plugins/Clipboard.dll
  • suspicious #2/Plugins/Cmd.dll
  • suspicious #2/Plugins/DDos.dll
  • suspicious #2/Plugins/Discord.dll
    .dll windows:4 windows x86 arch:x86

    dae02f32a21e03ce65412f6e56942daa


    Headers

    Imports

    Sections

  • suspicious #2/Plugins/DotNet.dll
  • suspicious #2/Plugins/Extra.dll
    .dll .ps1 windows:4 windows x86 arch:x86 polyglot

    dae02f32a21e03ce65412f6e56942daa


    Headers

    Imports

    Sections

  • suspicious #2/Plugins/File Manager.dll
  • suspicious #2/Plugins/FileManager.dll
    .dll windows:4 windows x86 arch:x86

    dae02f32a21e03ce65412f6e56942daa


    Headers

    Imports

    Sections

  • suspicious #2/Plugins/FileSearcher.dll
    .dll windows:4 windows x86 arch:x86

    dae02f32a21e03ce65412f6e56942daa


    Headers

    Imports

    Sections

  • suspicious #2/Plugins/Fun.dll
    .dll windows:4 windows x86 arch:x86

    dae02f32a21e03ce65412f6e56942daa


    Headers

    Imports

    Sections

  • suspicious #2/Plugins/HBrowser.dll
  • suspicious #2/Plugins/HRDP.dll
  • suspicious #2/Plugins/HVNC.dll
  • suspicious #2/Plugins/Helper.dll
  • suspicious #2/Plugins/HiddenApps.dll
  • suspicious #2/Plugins/HiddenProgram.dll
  • suspicious #2/Plugins/Hosts.dll
  • suspicious #2/Plugins/IconLib.dll
  • suspicious #2/Plugins/Information.dll
    .dll windows:4 windows x86 arch:x86

    dae02f32a21e03ce65412f6e56942daa


    Headers

    Imports

    Sections

  • suspicious #2/Plugins/Installedsoftwares.dll
  • suspicious #2/Plugins/Keylogger.dll
  • suspicious #2/Plugins/Keylogger.exe
    .exe windows:4 windows x86 arch:x86

    f34d5f2d4577ed6d9ceec516c1f5a744


    Headers

    Imports

    Sections

  • suspicious #2/Plugins/Logger.dll
    .dll windows:4 windows x86 arch:x86

    dae02f32a21e03ce65412f6e56942daa


    Headers

    Imports

    Sections

  • suspicious #2/Plugins/MessageBox.dll
  • suspicious #2/Plugins/MessagePackLib.dll
    .dll windows:4 windows x86 arch:x86

    dae02f32a21e03ce65412f6e56942daa


    Headers

    Imports

    Sections

  • suspicious #2/Plugins/Mic.dll
  • suspicious #2/Plugins/Mining.dll
  • suspicious #2/Plugins/Miscellaneous.dll
    .dll windows:4 windows x86 arch:x86

    dae02f32a21e03ce65412f6e56942daa


    Headers

    Imports

    Sections

  • suspicious #2/Plugins/Netstat.dll
    .dll windows:4 windows x86 arch:x86

    dae02f32a21e03ce65412f6e56942daa


    Headers

    Imports

    Sections

  • suspicious #2/Plugins/Options.dll
    .dll windows:4 windows x86 arch:x86

    dae02f32a21e03ce65412f6e56942daa


    Headers

    Imports

    Sections

  • suspicious #2/Plugins/Password.dll
  • suspicious #2/Plugins/Powershell.dll
  • suspicious #2/Plugins/ProcessManager.dll
    .dll windows:4 windows x86 arch:x86

    dae02f32a21e03ce65412f6e56942daa


    Headers

    Imports

    Sections

  • suspicious #2/Plugins/Ransomware.dll
  • suspicious #2/Plugins/Recovery.dll
    .dll windows:4 windows x86 arch:x86

    dae02f32a21e03ce65412f6e56942daa


    Headers

    Imports

    Sections

  • suspicious #2/Plugins/RecoviryPasswords.dll
  • suspicious #2/Plugins/Regedit.dll
    .dll windows:4 windows x86 arch:x86

    dae02f32a21e03ce65412f6e56942daa


    Headers

    Imports

    Sections

  • suspicious #2/Plugins/RegistryEditor.dll
  • suspicious #2/Plugins/RemoteCamera.dll
    .dll windows:4 windows x86 arch:x86

    dae02f32a21e03ce65412f6e56942daa


    Headers

    Imports

    Sections

  • suspicious #2/Plugins/RemoteDesktop.dll
    .dll windows:4 windows x86 arch:x86

    dae02f32a21e03ce65412f6e56942daa


    Headers

    Imports

    Sections

  • suspicious #2/Plugins/ReverseProxy.dll
    .dll windows:4 windows x86 arch:x86

    dae02f32a21e03ce65412f6e56942daa


    Headers

    Imports

    Sections

  • suspicious #2/Plugins/SClient.dll
  • suspicious #2/Plugins/SendFile.dll
    .dll windows:4 windows x86 arch:x86

    dae02f32a21e03ce65412f6e56942daa


    Headers

    Imports

    Sections

  • suspicious #2/Plugins/SendMemory.dll
    .dll windows:4 windows x86 arch:x86

    dae02f32a21e03ce65412f6e56942daa


    Headers

    Imports

    Sections

  • suspicious #2/Plugins/Services.dll
  • suspicious #2/Plugins/Startup.dll
  • suspicious #2/Plugins/StreamLib.dll
  • suspicious #2/Plugins/TCPConnection.dll
  • suspicious #2/Plugins/TaskManager.dll
  • suspicious #2/Plugins/USBSpread.dll
  • suspicious #2/Plugins/User ID.dll
  • suspicious #2/Plugins/WiFi.dll
  • suspicious #2/Plugins/lz4.AnyCPU.loader.dll
  • suspicious #2/Plugins/protobuf-net.dll
  • suspicious #2/Plugins/sc2.dll
    .dll windows:4 windows x86 arch:x86

    dae02f32a21e03ce65412f6e56942daa


    Headers

    Imports

    Sections

  • suspicious #2/QuickLZLibrary.dll
    .dll windows:4 windows x86 arch:x86

    dae02f32a21e03ce65412f6e56942daa


    Headers

    Imports

    Sections

  • suspicious #2/S500RAT.exe
    .exe windows:4 windows x86 arch:x86

    f34d5f2d4577ed6d9ceec516c1f5a744


    Headers

    Imports

    Sections

  • suspicious #2/S500RAT.ico
  • suspicious #2/Socks5.dll
    .dll windows:4 windows x86 arch:x86

    dae02f32a21e03ce65412f6e56942daa


    Headers

    Imports

    Sections

  • suspicious #2/SunnyUI.Common.dll
    .dll windows:4 windows x86 arch:x86

    dae02f32a21e03ce65412f6e56942daa


    Headers

    Imports

    Sections

  • suspicious #2/SunnyUI.dll
    .dll windows:4 windows x86 arch:x86

    dae02f32a21e03ce65412f6e56942daa


    Headers

    Imports

    Sections

  • suspicious #2/Svg.dll
    .dll windows:4 windows x86 arch:x86

    dae02f32a21e03ce65412f6e56942daa


    Headers

    Imports

    Sections

  • suspicious #2/Terror/1.gif
    .gif
  • suspicious #2/Terror/2.gif
    .gif .ps1 polyglot
  • suspicious #2/Terror/3.gif
    .gif
  • suspicious #2/Terror/4.gif
    .gif
  • suspicious #2/Terror/T.wav
  • suspicious #2/Thumbs.db
  • suspicious #2/Tulpep.NotificationWindow.dll
    .dll windows:4 windows x86 arch:x86

    dae02f32a21e03ce65412f6e56942daa


    Headers

    Imports

    Sections

  • suspicious #2/Vestris.ResourceLib.dll
    .dll windows:4 windows x86 arch:x86

    dae02f32a21e03ce65412f6e56942daa


    Headers

    Imports

    Sections

  • suspicious #2/WinMic.dll
    .dll windows:4 windows x86 arch:x86

    dae02f32a21e03ce65412f6e56942daa


    Headers

    Imports

    Sections

  • suspicious #2/WinSound.dll
    .dll windows:4 windows x86 arch:x86

    dae02f32a21e03ce65412f6e56942daa


    Headers

    Imports

    Sections

  • suspicious #2/cGeoIp.dll
    .dll windows:4 windows x86 arch:x86

    dae02f32a21e03ce65412f6e56942daa


    Headers

    Imports

    Sections

  • suspicious #2/dnlib.dll
    .dll windows:4 windows x86 arch:x86

    dae02f32a21e03ce65412f6e56942daa


    Headers

    Imports

    Sections

  • suspicious #2/initialization.dll
    .dll windows:4 windows x86 arch:x86

    dae02f32a21e03ce65412f6e56942daa


    Headers

    Imports

    Sections

  • suspicious #2/lz4.AnyCPU.loader.dll
    .dll windows:4 windows x86 arch:x86

    dae02f32a21e03ce65412f6e56942daa


    Headers

    Imports

    Sections

  • suspicious #2/protobuf-net.dll
    .dll windows:4 windows x86 arch:x86

    dae02f32a21e03ce65412f6e56942daa


    Headers

    Imports

    Sections

  • suspicious #2/sc2.dll
    .dll windows:4 windows x86 arch:x86

    dae02f32a21e03ce65412f6e56942daa


    Headers

    Imports

    Sections

  • suspicious #2/settings.xml
  • suspicious #2/zxing.dll
    .dll windows:4 windows x86 arch:x86

    dae02f32a21e03ce65412f6e56942daa


    Headers

    Imports

    Sections