Overview

overview

10

Static

static

10

ba26a99c0d...4c.exe

windows7-x64

10

ba26a99c0d...4c.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    ba26a99c0daf9cd1d6184533264786fb0841fa9c0aa0ed9c6edc5cafa398ae4c.exe

  • Size

    63KB

  • MD5

    a93233b10537a2cc3d9d1fd07845a2fb

  • SHA1

    c04e99492c4ea06dd2e56f3f91ea224682b8462b

  • SHA256

    ba26a99c0daf9cd1d6184533264786fb0841fa9c0aa0ed9c6edc5cafa398ae4c

  • SHA512

    418769e3ca3bfdbff20113b9ad575014deee8266db50be50505f1af335b3628b648e7c34b1c5b9e75f8a25a01578f4f4b90eee90a9bc0834515f9cc6bfda275a

  • SSDEEP

    1536:5hjExLDRwQuNMXbmaeWs1l7a8QeRmGbbcw0bgT7G3tpqKmY7:5hjExLDRwQuNMXbreFlBQe4Gbbch2z

Score
10/10
ratdefaultasyncrat

Malware Config

Extracted

Family

asyncrat

Version

1.0.7

Botnet

Default

C2

103.249.112.118:8848

Mutex

DcRatMutex_qwqdanchun

Attributes
  • delay

    1

  • install

    false

  • install_folder

    %AppData%

aes.plain

Signatures

  • Async RAT payload 1 IoCs
    rat
  • Asyncrat family
    asyncrat
  • Detects executables attemping to enumerate video devices using WMI 1 IoCs
  • Detects executables containing the string DcRatBy 1 IoCs
  • Unsigned PE 1 IoCs

    Checks for missing Authenticode signature.

Files

  • ba26a99c0daf9cd1d6184533264786fb0841fa9c0aa0ed9c6edc5cafa398ae4c.exe
    .exe windows:4 windows x86 arch:x86

    f34d5f2d4577ed6d9ceec516c1f5a744


    Headers

    Imports

    Sections