asyncrat | 8[.]zip

General

Target
8.zip
Size 18.2MB
Sample240623-nte7jayhqa
SHA256 0b11ccb96e99cea6f7bc307695a2b94415728b005a516e551a4f1dee24dd6296
MD5 eb4fdf877381161ccf014e26359fe018
SHA1 4b8b5c72c0d808e4e1ea5f5b7795a6e18611607b
SHA512 0e3389c65b0034586d50bf27180db2ab0a8d5f7924529dfadb3571978a3e9c6cc70fc3bcdb4a45fc049846b537d27ba1865c0106306f7960f315f7316e06f70f
SSDEEP 393216:cZycN9W5dCUl+KeaAo7hVfRJRi/PymUOygldiyC7vlt/e/eBB3:cZyUaUUlm2vRa37N/ldeDl964B
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

(_!_d@ys_!_)asyncrat

Malware Config

Extracted

Family

asyncrat

Version

RIMAWI 1.0.2.9

Botnet

(_!_D@YS_!_)

C2

127.0.0.1:36365

Mutex

AZSXDCFVGBHNqwertyui

Attributes

delay
3
install
false
install_folder
%AppData%

aes.plain

Signatures

Asyncrat family
asyncrat

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
unpack001/VideoVLC_subtitles.exe

File Explorer

8.zip

.zip 18.2MB
VideoVLC_Subtitle.ps1

.ps1 639B
VideoVLC_subtitles.exe

.exe 20.4MB

8.zip

SHA256 0b11ccb96e99cea6f7bc307695a2b94415728b005a516e551a4f1dee24dd6296
MD5 eb4fdf877381161ccf014e26359fe018
SHA1 4b8b5c72c0d808e4e1ea5f5b7795a6e18611607b
SHA512 0e3389c65b0034586d50bf27180db2ab0a8d5f7924529dfadb3571978a3e9c6cc70fc3bcdb4a45fc049846b537d27ba1865c0106306f7960f315f7316e06f70f
SSDEEP 393216:cZycN9W5dCUl+KeaAo7hVfRJRi/PymUOygldiyC7vlt/e/eBB3:cZyUaUUlm2vRa37N/ldeDl964B
MD5 SHA1 SHA512 SSDEEP

VideoVLC_subtitles.exe

IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
SHA256 a562909c5c9b7b8c20484cd0822e2c379d36a34432ef11306bf1e1f28762aeb6
MD5 dea45ddf6c0ae0f9f3fde1bfd53bc34f
SHA1 d59685be110ed0b0fcecb09740769a38ddd39c8e
SHA512 b78ce76e8055ebbdc7280b411e957e5357537d1d693249873f906c9a9b7f2aa13aab949ad7743d1cfcc3eef99eb3ffceaffd6fa88a5df8b313744500f55107f6
SSDEEP 393216:4fAUv/DWT9lrqm59DJjhe+NRDWUFnAUv/DWT9lrqm5ordQll/LY/:Dl3NR3wl3Vlc
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

21366414

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

8.zip

VideoVLC_Subtitle.ps1

VideoVLC_subtitles.exe

mscoree

dotnet

Sharing

General

Malware Config

Extracted

Signatures

File Explorer

8.zip

VideoVLC_Subtitle.ps1

VideoVLC_subtitles.exe

mscoree

dotnet