COMPILED.zip
- SHA256 0b29711ec115c27f4cd6963b9ea1e4febf15624f1c17d1c018611ee3df8c333c
General
- Target COMPILED.zip
- Size 6.9MB
- Sample240503-vld3tsed58
- SHA256 0b29711ec115c27f4cd6963b9ea1e4febf15624f1c17d1c018611ee3df8c333c
- MD5 30b1961a9b56972841a3806e716531d7
- SHA1 63c6880d936a60fefc43a51715036c93265a4ae5
- SHA512 9449065743226bd15699e710b2bab2a5bb44866f2d9a8bd1b3529b7c53d68e5ecba935e36406d1b69e1fb050f50e3321ef91bc61faac9790f6209fec6f930ed0
- SSDEEP 196608:C+MPQJu8YfQFtMAFMQ5RIhFmQ06L29tJW0SCK5u:C+mQ08YfQNMQ5RI7i9LSCAu
- MD5 SHA1 SHA512 SSDEEP
Malware Config
Signatures
- Async RAT payload 1 IoCs
resource yara_rule static1/unpack001/AsyncRAT/Stub/Stub.exe family_asyncrat - Asyncrat family
- Detect ZGRat V1 13 IoCs
resource yara_rule static1/unpack001/AsyncRAT/Plugins/Chat.dll family_zgrat_v1 static1/unpack001/AsyncRAT/Plugins/Extra.dll family_zgrat_v1 static1/unpack001/AsyncRAT/Plugins/FileManager.dll family_zgrat_v1 static1/unpack001/AsyncRAT/Plugins/FileSearcher.dll family_zgrat_v1 static1/unpack001/AsyncRAT/Plugins/LimeLogger.dll family_zgrat_v1 static1/unpack001/AsyncRAT/Plugins/Miscellaneous.dll family_zgrat_v1 static1/unpack001/AsyncRAT/Plugins/Options.dll family_zgrat_v1 static1/unpack001/AsyncRAT/Plugins/ProcessManager.dll family_zgrat_v1 static1/unpack001/AsyncRAT/Plugins/Recovery.dll family_zgrat_v1 static1/unpack001/AsyncRAT/Plugins/RemoteCamera.dll family_zgrat_v1 static1/unpack001/AsyncRAT/Plugins/RemoteDesktop.dll family_zgrat_v1 static1/unpack001/AsyncRAT/Plugins/SendFile.dll family_zgrat_v1 static1/unpack001/AsyncRAT/Plugins/SendMemory.dll family_zgrat_v1 - Zgrat family
- Unsigned PE 15 IoCs
Checks for missing Authenticode signature.
resource unpack001/AsyncRAT/AsyncRAT.exe unpack001/AsyncRAT/Plugins/Chat.dll unpack001/AsyncRAT/Plugins/Extra.dll unpack001/AsyncRAT/Plugins/FileManager.dll unpack001/AsyncRAT/Plugins/FileSearcher.dll unpack001/AsyncRAT/Plugins/LimeLogger.dll unpack001/AsyncRAT/Plugins/Miscellaneous.dll unpack001/AsyncRAT/Plugins/Options.dll unpack001/AsyncRAT/Plugins/ProcessManager.dll unpack001/AsyncRAT/Plugins/Recovery.dll unpack001/AsyncRAT/Plugins/RemoteCamera.dll unpack001/AsyncRAT/Plugins/RemoteDesktop.dll unpack001/AsyncRAT/Plugins/SendFile.dll unpack001/AsyncRAT/Plugins/SendMemory.dll unpack001/AsyncRAT/Stub/Stub.exe
File Explorer
-
COMPILED.zip.zip 6.9MB
-
AsyncRAT/AsyncRAT.exe.exe 6.4MB
-
AsyncRAT/AsyncRAT.exe.config.xml 5KB
-
AsyncRAT/Plugins/Chat.dll.dll 367KB
-
AsyncRAT/Plugins/Extra.dll.dll 375KB
-
AsyncRAT/Plugins/FileManager.dll.dll 392KB
-
AsyncRAT/Plugins/FileSearcher.dll.dll 433KB
-
AsyncRAT/Plugins/LimeLogger.dll.dll 368KB
-
AsyncRAT/Plugins/Miscellaneous.dll.dll 560KB
-
AsyncRAT/Plugins/Options.dll.dll 378KB
-
AsyncRAT/Plugins/ProcessManager.dll.dll 361KB
-
AsyncRAT/Plugins/Recovery.dll.dll 600KB
-
AsyncRAT/Plugins/RemoteCamera.dll.dll 452KB
-
AsyncRAT/Plugins/RemoteDesktop.dll.dll 390KB
-
AsyncRAT/Plugins/SendFile.dll.dll 368KB
-
AsyncRAT/Plugins/SendMemory.dll.dll 367KB
-
AsyncRAT/Stub/Stub.exe.exe 38KB
AsyncRAT/AsyncRAT.exe
- IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
- SHA256 06899071233d61009a64c726a4523aa13d81c2517a0486cc99ac5931837008e5
- MD5 97a429c4b6a2cb95ece0ddb24c3c2152
- SHA1 6fcc26793dd474c0c7113b3360ff29240d9a9020
- SHA512 524a63f39e472bd052a258a313ff4f2005041b31f11da4774d3d97f72773f3edb40df316fa9cc2a0f51ea5d8ac404cfdd486bab6718bae60f0d860e98e533f89
- SSDEEP 98304:+bPmDVa3VxobFwUN5xXhAqin1MNuSZTKA0t9FFPEG6xJJ33Je2PsBpCz6Ry:+7aIXUN5htin2bk9fcPHJDE7Cz60
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
6681982
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB paths
mscoree
_CorExeMain
Name
.text
Size
6.4MB
Virtual Size
6.4MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
31KB
Virtual Size
30KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
AsyncRAT/AsyncRAT.exe.config
- SHA256 58f956abe9d717683f4a1cfa6f70e256c80461315a8d47b6456116b3d3075372
- MD5 cb1f2dcfeb5cbb5af8efa7ea40b8e908
- SHA1 ceb040761554040cac2fc7ca18623498d3bfc7ce
- SHA512 f0d805bb7983a111b7083e08d5e53c30dd78a0a5fa2baa2af6c5d3395475a3399fd085d151cc8cce312c7eb3e11ac7c2cc78c49ff8a9bfba4b6ad6585caeaeea
- SSDEEP 96:ur71Y7KY7KPrv0bGiver/apdgaRzV6RnwhXIJ0bGiveLapdgaRzV6RQyYKS4Ypy1:ur7S7L7OrTbCyYKS/pvrsJ+J/qJvr
- MD5 SHA1 SHA512 SSDEEP
AsyncRAT/Plugins/Chat.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 37d41c7042210845593ddd7e5a5e37a37f6605305264d50a30aa2be1686000f6
- MD5 b230da150aa974d2a0801cef654cbe05
- SHA1 ab28e63c165ebd7d43d6d0eed4de2750743b9b27
- SHA512 2d81546548b6ed2e799eaaf4766ac9a811344d9f57726bed7270e289234f7b917df07deff9d1f6e93b9f4d186daefcbfd2d0181b12406a0b5b81e3bdffa65aaf
- SSDEEP 6144:x5S/ect/xQQq1EFBa1jTfHjGqyREilSwAV:x5G/e1EFQ1jzjGREy
- MD5 SHA1 SHA512 SSDEEP
-
Detect ZGRat V1
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
382030
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
mscoree
_CorDllMain
Name
.text
Size
365KB
Virtual Size
365KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
804B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
AsyncRAT/Plugins/Extra.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 7dd3978e7721f4460d639d17c47fe1307917dbacfb858d0d12e403105cd47089
- MD5 3bbcb7c7967c714f767d751db17ed1d0
- SHA1 ea15b176c5c7073bfa3bb58ebe9280b032414fbc
- SHA512 c20bf3b9b4051b050b6efebbe3c6ea54e520d68172f4ef7bbab961169c4479e9c77b39719e0139edd6ff4c4366b355579226f49aa979331ac8ab8c69bf3a165f
- SSDEEP 6144:/rUTePJZAbxMCgxth8mzMkv8WLBuqcLA5rm5N8LBOTqi:/jA6jL93J4H
- MD5 SHA1 SHA512 SSDEEP
-
Detect ZGRat V1
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
390590
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
mscoree
_CorDllMain
Name
.text
Size
373KB
Virtual Size
373KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
804B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
AsyncRAT/Plugins/FileManager.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 9d1b94035f381b5183e82a317f001725674c8ea1c5cd82ab5af408f7f53ca19d
- MD5 9caa1fa3b3b7824167610d309446223d
- SHA1 093fa014488ea1ddacf083c398fb8b2d07b8a0e0
- SHA512 feba121ed3ccdef26b0c78874c5247cbb223b2992649fed6bbc088bfe952cf86de1145d84666048ad37b0f2c6a9dcd4da95cf972ec790b43deeb1c22322d17e1
- SSDEEP 6144:6vqHIAq0cvNthE4a2pO/LyRJPZVjTT6gsduuufuujuFyJTququqqqqqqLffffqpU:6vqH/glcwkU5mgsRU0OGF
- MD5 SHA1 SHA512 SSDEEP
-
Detect ZGRat V1
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
407918
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
mscoree
_CorDllMain
Name
.text
Size
390KB
Virtual Size
390KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
684B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
AsyncRAT/Plugins/FileSearcher.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 a6bdd625fa1d9a7ee66e4ca09ced0b3dca8afd2ad92ecaf44fd9a879b57cb198
- MD5 4e1922ee8333847507a34823ed695131
- SHA1 5df1f96b0a0a43eadeb101c54864a85cf51e9521
- SHA512 e4f2bc24f7d44e19580d561599b563ef2d011cffbd64851c867b03aab22e650da55150b6bc9c02389acffe546efdcc17da72204fef4e6e49a53e27be1a290f0a
- SSDEEP 6144:TwLb1j1VL6d/kA1EegwpfzSv/OLpvt4WIkE0ej:Tib1jKcA1ow9+Q2WIkE0e
- MD5 SHA1 SHA512 SSDEEP
-
Detect ZGRat V1
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
449086
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
mscoree
_CorDllMain
Name
.text
Size
431KB
Virtual Size
430KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
836B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
AsyncRAT/Plugins/LimeLogger.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 cd5cdf0eade067fb0d97881258e4e29d88386cc9ec7a6ea315d159d284858857
- MD5 732839c93b7e0ab6796cb1c4544eda66
- SHA1 2dc3d39d74a5b72e6320596f92bcfc15edda3915
- SHA512 faa264925d636fa743d0448ce97c0b26ed7974b48c2fbf66000993119749d721bc27cf2626c3eaac3b1374abc0d16cca9e8222c4da054d1aeb56b34505fbeec6
- SSDEEP 6144:T7qj3iWg0kHC86FItOZrhFx4aXCEzwHyFt:T03iutXCa2g
- MD5 SHA1 SHA512 SSDEEP
-
Detect ZGRat V1
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
383294
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
mscoree
_CorDllMain
Name
.text
Size
366KB
Virtual Size
366KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
828B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
AsyncRAT/Plugins/Miscellaneous.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 783d9d5334aa40f35acf8ff941a6b5bed908fd94dc14a05712b8a9eb9220cd5b
- MD5 07ba8685ca3faff186f0d9f5400c1117
- SHA1 a673a7b55e4cf168856a7d3564a5521f0f8fc4e5
- SHA512 358c85a586d8b590497ea180eae76608ef38a4de09b95e907632bbad8f2c522bec4ea5568017ea1120a1553abb2be730006613872fe053b1fc00a36d005ab096
- SSDEEP 6144:ZksM6LbRsGOlShLHZIVEvLht0Raf2K/lPqmiGk4IuzvjPEzd4P0m/KUweRq:pM6nRsHlSRLBuwImD5f88B
- MD5 SHA1 SHA512 SSDEEP
-
Detect ZGRat V1
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
579614
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
mscoree
_CorDllMain
Name
.text
Size
558KB
Virtual Size
558KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
692B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
AsyncRAT/Plugins/Options.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 8dc80b8bf9b3123289e132270e74a31176deec4f74e6ac20d7b6a9fcdb89e8a1
- MD5 a1b5048e3f10f7105bd47244b2930137
- SHA1 a12cbae3ec815ce704fafb0e2eadb9f31ccbb6f3
- SHA512 fcae7c456f71e03afe2e67954fc3c9491978a54825436c51b351c47adb6cd8a1ef15e0e6f6d99094b986ff910e21a287a7de9e4ca2818221aa858152a8c6dfe9
- SSDEEP 6144:k7VK+5AKNyvekG+3IoH3MAYV+kpDBWOcFN94f:kk3Kg731H3Md+XHf9
- MD5 SHA1 SHA512 SSDEEP
-
Detect ZGRat V1
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
392830
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
mscoree
_CorDllMain
Name
.text
Size
376KB
Virtual Size
375KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
812B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
AsyncRAT/Plugins/ProcessManager.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 3ad861ad9bc3edfdd486c060879f4f2450a51757c67f3b514f71381057580218
- MD5 fced22a0c1edad786a59703842fd3b14
- SHA1 dceabc613c694f7f2f6439ea176988fb373d6a29
- SHA512 8904c36c364d29244c598895e877d7897547ce2a187adb197ba281a0512ca3ff52464c478fc42a2ec7f614dd0f91dea2dbb31f4af81c6c0f08cd23f79a71f57c
- SSDEEP 6144:hyk5beTVvGG3vwtudJgKsvAjHvzA1AXly:wNGGotYJQvgHbKA
- MD5 SHA1 SHA512 SSDEEP
-
Detect ZGRat V1
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
376158
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
mscoree
_CorDllMain
Name
.text
Size
359KB
Virtual Size
359KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
844B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
AsyncRAT/Plugins/Recovery.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 7fd48ac68f182e0ced2ace00b223fa1d35bd8a20d75600b5400267cd5db5cc84
- MD5 d8793438a77750cea1b0d7eaad3d0d0d
- SHA1 36bb36d6dabaa1285dbe7ba26581322630984c71
- SHA512 68e00d97edf0ab768d40672d3b39dfcd09d8ff81b3e6abfdcfa8db88d66ae6070c8b6ad2c540538dd6f47da0174f9ab2d48cd7bef95d6021ffb844c71289822d
- SSDEEP 12288:3I5Ii5aNgfO5Bt844Wn1JwygRuE4pYGmDonx:3IcqfOryJWnVrYNDIx
- MD5 SHA1 SHA512 SSDEEP
-
Detect ZGRat V1
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
620462
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
mscoree
_CorDllMain
Name
.text
Size
598KB
Virtual Size
597KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
820B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
AsyncRAT/Plugins/RemoteCamera.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 87938027a63a867b831c86611dc6a2c1fc6af61526dc2269328af4b59e15b1e1
- MD5 1b2c9164e625b600e699151de11d9e98
- SHA1 2ce0aa3161c641623afd1acfa922fce5f10a709c
- SHA512 aa0785b079059463a1df409380451c2be7c3bd627a199661627815f364689ed3816dc9cb78725fab510d687d6866186f3fbdb62b633554b9a0aa324730487729
- SSDEEP 6144:npMSjYV8M+c7YervSBlnzYuYyb5A5XAxCqDS5aVorhdt+b5V20JBmYrtog:nqV8a0OaLYCAQLD8CF5h3t
- MD5 SHA1 SHA512 SSDEEP
-
Detect ZGRat V1
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
468926
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
mscoree
_CorDllMain
Name
.text
Size
450KB
Virtual Size
449KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
836B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
AsyncRAT/Plugins/RemoteDesktop.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 56fd699258a7186f709068c283cd725797bab392e3a6f1cd28f35bbdb3e98e38
- MD5 cd4a9e669264419eca4de564e6272fe0
- SHA1 bb69bb1542ea06395df74dbedc98866d6c8a36cb
- SHA512 5addb4f97c7e1cb69e5167e670bd2c3a817e0415f1fd8a5158af7e03e4340a8b1a6d803e85c9ea56415b9e7d3dcb4c352775a6a6b4770443d72114396ffaa1e5
- SSDEEP 6144:KdHdVObvTS8nmScJEB/2Jin8SF1hG+ht6Oaynf/wKlWCkKI5J5sZva:xCQ2wHFagf/wKlncg
- MD5 SHA1 SHA512 SSDEEP
-
Detect ZGRat V1
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
405310
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
mscoree
_CorDllMain
Name
.text
Size
388KB
Virtual Size
387KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
836B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
AsyncRAT/Plugins/SendFile.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 1a717c40ff7f60c18953b46a69a8fc47cce7dad6116cd3715deb2abf0d80722d
- MD5 c4b11c003ed1e394597f6a5201826a59
- SHA1 8de5d19d0d1638f24718bf87c3245cef74f48341
- SHA512 ee93a9bd9f77284af5fe0b4d1ef96fbb0ded00aeb045cae380bfc01be45c76d9d0a481f1d4a6f206124603b99c23a8b6054dcdc65e7e5913373b1739e1b310b1
- SSDEEP 6144:7aU0XFbDW0+JDzXNj8QrGchz6q7V7u85:7aU0XCJDbdnrGyT1
- MD5 SHA1 SHA512 SSDEEP
-
Detect ZGRat V1
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
382782
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
mscoree
_CorDllMain
Name
.text
Size
366KB
Virtual Size
365KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
820B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
AsyncRAT/Plugins/SendMemory.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 b0b5dda6cac5d1e91958379dc1fda602dd1566127f21e30196382743a350a4d8
- MD5 dbd937cf1098405994b1295056dce5bb
- SHA1 9b47cff5dc8cc6b4868a3715412b425c2b5b49cf
- SHA512 2795b1249829d43f43291394fd33821caa3a0ed654c3d9a75f0cd52ac94f1e1bb3d2ab87f81333779d789112c359ddb059c8b4616c95903761b1539e54ec9d61
- SSDEEP 6144:QJ+x17+H67OgnfFPE0f4UKXdEvllmXOocZqOA8IhOueA1Cv6afvx:iPonRE0f4UKXdE9lmXOocZqD51CyE
- MD5 SHA1 SHA512 SSDEEP
-
Detect ZGRat V1
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
381438
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
mscoree
_CorDllMain
Name
.text
Size
365KB
Virtual Size
364KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
828B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
AsyncRAT/Stub/Stub.exe
- IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
- SHA256 0e19cefba973323c234322452dfd04e318f14809375090b4f6ab39282f6ba07e
- MD5 f76702fa423ce2b2b4b0fdcf547b0789
- SHA1 ea408a4419e8a3139ef14df987608964c12d3190
- SHA512 03c7d8814687bb4f11ac41a555f368d89d5be749c92624073b77da0e57d872df201f2657b180ad0c9d5bc9ffa0a85989bf31374c7e5deefa06cf36bce3697971
- SSDEEP 768:9Xaug0LrCc4d7VtOjkR26/XgNhKwEuyj67zACVyI1rXDjkY5Z07:dafSuVtOGfgTKwt3Nk7
- MD5 SHA1 SHA512 SSDEEP
-
Async RAT payload
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
44002
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB paths
mscoree
_CorExeMain
Name
.text
Size
35KB
Virtual Size
34KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
2KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ