asyncrat | unpacked2 | Triage

Sharing

General

Target

unpacked2
Size

47KB
MD5

f21077da13baf7bdd3774e494442d0c7
SHA1

d05d378e12d5a0c45708bbb565998916b90db0b0
SHA256

2913084e0262f800377a93c1cfbd854151857076a88ab26b8f20be39b4c50fa2
SHA512

984a9edf499f65d06601ee3bd7a7d99b37aad846cde4d4b60090138a7486457b0e585eedb16b71c63888e9a42c5bb54afc2d0f6efc1cb0eb4550415a954504b7
SSDEEP

768:Ts9DILA+Es+binXgvhCl5Zig8Yb9ge2sJ7vEgK/JnZVc6KN:TsDUIK7zbqHsJ7nkJnZVclN

Score

10^/10

rat default asyncrat

Malware Config

Extracted

Family

asyncrat

Version

1.0.7

Botnet

Default

C2

wevdjjakfr.duckdns.org:8010

Mutex

DcRatMutex_qwqdanchun

Attributes

delay
1
install
false
install_file
jueves.exe
install_folder
%AppData%

aes.plain

Signatures

Async RAT payload 1 IoCs
rat

Processes:

resource yara_rule

sample family_asyncrat
Asyncrat family
asyncrat
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.

Processes:

resource

unpacked2

Files

unpacked2
.exe windows:4 windows x86 arch:x86

f34d5f2d4577ed6d9ceec516c1f5a744

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE

Imports

mscoree

_CorExeMain

Sections

.text
Size: 43KB - Virtual size: 42KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 3KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ