asyncrat | wil25[.]exe | Triage

Sharing

General

Target

wil25.exe
Size

47KB
MD5

21e648cfae4d4cf760a1a415c712df22
SHA1

71f75e83f9512dfdc4ec5d77d57a8b87a877d3e9
SHA256

0bcc2c4d42966857ff5c047308049fe1a7a2b8bf393957fa07c85623488ce50f
SHA512

d484ecd05225b09a4def89d72943f463ea760ba0615fcea5b87db485f9586cba958ac7cc734fb224e4bd3168080e73533843b76258789074619bde619443e743
SSDEEP

768:BCT3ILNCKi+DiP8l5MBN/QisVY8YbPgw7qm7dfqvEgK/JrZVc6KN:BCYmUMiYzb4DginkJrZVclN

Score

10^/10

rat asyncrat

Malware Config

Extracted

Family

asyncrat

Version

1.0.7

C2

myhostnamejuly.kozow.com:4503

Mutex

5yubtrvtybve5_qwqdanchun

Attributes

delay
1
install
false
install_folder
%AppData%

aes.plain

Signatures

Async RAT payload 1 IoCs
rat

Processes:

resource yara_rule

sample family_asyncrat
Asyncrat family
asyncrat
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.

Processes:

resource

wil25.exe

Files

wil25.exe
.exe windows:4 windows x86 arch:x86

f34d5f2d4577ed6d9ceec516c1f5a744

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE

Imports

mscoree

_CorExeMain

Sections

.text
Size: 43KB - Virtual size: 42KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 3KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ