Behavioral task
behavioral1
Sample
2488-94-0x0000000000400000-0x0000000000422000-memory.exe
Resource
win7-20231129-en
Behavioral task
behavioral2
Sample
2488-94-0x0000000000400000-0x0000000000422000-memory.exe
Resource
win10v2004-20231215-en
General
-
Target
2488-94-0x0000000000400000-0x0000000000422000-memory.dmp
-
Size
136KB
-
MD5
bac86b3d2477885ec482cb7a2be8038c
-
SHA1
22b84520390234384e5b0057c814e045d7cb91e6
-
SHA256
4577e8ba1855afa1d397e06eb5e07b8dd6b2f42ea7894446d7ce60b2e771e686
-
SHA512
7bacf26288abdeccd790f94139d49cf4e6ab6395d61637fab8a80a7c00f78c3fcd7d4264fa0b1388a87158f3c87d5e75699c1a720e0d2536aaff8d39d39903f2
-
SSDEEP
1536:YaDo19gYmvY1O+JYUbFh9kliJYuIdpqKmY7Rw9K2hAYUbFh9klcJKjB:YasA7EYUbFgliJOGznxAYUbFglcJ
Malware Config
Extracted
asyncrat
Default
尺vcΕ贼2C伊R开tΗKTتDmF尺
-
c2_url_file
https://fvia.app/ip2.txt
-
delay
5
-
install
false
-
install_folder
%Windows%
Signatures
Files
-
2488-94-0x0000000000400000-0x0000000000422000-memory.dmp.exe windows:4 windows x86 arch:x86
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
Sections
.text Size: 58KB - Virtual size: 58KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 3KB - Virtual size: 3KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
.text Size: 42KB - Virtual size: 41KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ