asyncrat | zOcVkDxFpuASDc4Bz6QtsmovLGR3IVKEk3NOUknK[.]zip | Triage

Sharing

Copy URL Twitter E-mail

General

Target

zOcVkDxFpuASDc4Bz6QtsmovLGR3IVKEk3NOUknK.zip
Size

239KB
MD5

5441929e3352f7d3218212cfb1c35a75
SHA1

f929964565eed9428eb7a8456d8c3f986457b71b
SHA256

0c5d5842eef433bc605bd131b242d1f558fef5797a823b59a8196f420032cffb
SHA512

44510e8264efbe2d839ab231966cbc06210d9ea7edf7881d46796282297b7f61ffddb80cb58a6b72f12e0f018736218834f690657008d9bdb90ce8f88e773d5b
SSDEEP

6144:BlKrwzNPufGgWafLnquhnP/6bmlqgVIVvt4npohQ:GMh/UfLnBhP/6bhVvWohQ

Score

10^/10

rat default asyncrat

Malware Config

Extracted

Family

asyncrat

Botnet

Default

Mutex

1K弗JץץAd2rwFaתNDh比P2

Attributes

delay
1
install
true
install_file
svchost.exe
install_folder
%AppData%
pastebin_config
https://pastebin.com/raw/z5PQ82wE

aes.plain

Signatures

Async RAT payload 1 IoCs

resource	yara_rule
static1/unpack001/Krampus/ferUjasO2.exe	family_asyncrat

Asyncrat family
asyncrat

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
unpack001/Krampus/ferUjasO2.exe

Files

zOcVkDxFpuASDc4Bz6QtsmovLGR3IVKEk3NOUknK.zip
.zip
Krampus/UserManual.txt
Krampus/ferUjasO2.exe
.exe windows:4 windows x86 arch:x86

f34d5f2d4577ed6d9ceec516c1f5a744

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE

Imports

mscoree

_CorExeMain

Sections

.text
Size: 59KB - Virtual size: 58KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 3KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Krampus/fuckkrampus.png
.png
Krampus/readme.txt