asyncrat | ZChairs_Cracked[.]exe | Triage

Sharing

General

Target

ZChairs_Cracked.exe
Size

11.1MB
MD5

d99dd4f4763f9e96b7f056fb263ffbc0
SHA1

901ec917719cb5e1b5c8ebd5ea7fa3fd298c78ca
SHA256

a7deb4fce1107c6e23476303eaa786acc6e691317bdaa8c0728453eb5c1a3aa9
SHA512

9dca5b8734e1668a4e2739457fb5342549651bbcc28ab98d4c7d3a53f125d4d7b527d428d9561bc7aa30cd540ec6461f065d1b900cf176725b8b8cd453498bcf
SSDEEP

196608:znkAYRfWA3OnTHTTmx2aOHzKTo/lc2gg:rkAEWMOnTHTxRHz7G6

Score

10^/10

rat asyncrat

Malware Config

Signatures

Async RAT payload 1 IoCs

resource	yara_rule
sample	asyncrat

Asyncrat family
asyncrat

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
ZChairs_Cracked.exe

Files

ZChairs_Cracked.exe
.exe windows:4 windows x86 arch:x86

f34d5f2d4577ed6d9ceec516c1f5a744

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

mscoree

_CorExeMain

Sections

.text
Size: 11.1MB - Virtual size: 11.1MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ