Behavioral task
behavioral1
Sample
5fe70d03f7e09b37bbc1df3a7dfe051472ecefd0f4d3a353050bf34f09cc8590.exe
Resource
win7-20240708-en
General
-
Target
5fe70d03f7e09b37bbc1df3a7dfe051472ecefd0f4d3a353050bf34f09cc8590
-
Size
74KB
-
MD5
5477db85d8176f46b0e7f060580ef1f6
-
SHA1
f4449f79c4ab7bfd9626ba6bb3e4cfcfcad4f1e8
-
SHA256
5fe70d03f7e09b37bbc1df3a7dfe051472ecefd0f4d3a353050bf34f09cc8590
-
SHA512
e67089fe1cb20f99bdd6be339fdac45b3ea76ca28f9524c04ea0a946e0d083ec36c1fb85688a53923c739befa1d66cabea4eec315433c6b56fa9bb399484534f
-
SSDEEP
1536:LAUUkcxNW18Qb4KT0al0XSjYa0cLJSPMwFdhMlaN7d6fH1bfbVsVw4wzURLVclN:LAUBcxNW18QEKT0al0XSjYa0c9SPMw9I
Malware Config
Extracted
asyncrat
Ninja - X Remote Administration Tool v9.0.2
Default
157.20.182.102:4449
pmozufzydayusfgpzfl
-
delay
1
-
install
false
-
install_folder
%AppData%
Signatures
-
Async RAT payload 1 IoCs
resource yara_rule sample family_asyncrat -
Asyncrat family
-
resource yara_rule sample VenomRAT -
Venomrat family
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 5fe70d03f7e09b37bbc1df3a7dfe051472ecefd0f4d3a353050bf34f09cc8590
Files
-
5fe70d03f7e09b37bbc1df3a7dfe051472ecefd0f4d3a353050bf34f09cc8590.exe windows:4 windows x86 arch:x86
f34d5f2d4577ed6d9ceec516c1f5a744
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
Imports
mscoree
_CorExeMain
Sections
.text Size: 69KB - Virtual size: 69KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 3KB - Virtual size: 3KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ