asyncrat | Api-AutoUpdater[.]exe | Triage

Sharing

General

Target

Api-AutoUpdater.exe
Size

63KB
MD5

e8df591dd750558b2643bb1332c5245c
SHA1

418f549bca86c939f4fcb250a18ac3467eb4c2ca
SHA256

721fb4159bb039e3dcf8e2bc2ba3b24ed75eaf52ec94a35765cede3660917ad3
SHA512

a6d0aa3cebd0928833d01e3fe4e39409dc06ec9d01d0342d42d2e42746fe57f7621c7f116a4d2650bb9efea9e5b77a074d12d58581b057eb2dd9994fcddfd93f
SSDEEP

1536:TeQPczZ9d84YUbAhed527Iu4ucdpqKmY7:TeDzZ9d9YUbATIuaGz

Score

10^/10

rat default asyncrat

Malware Config

Extracted

Family

asyncrat

Botnet

Default

C2

specific-charles.gl.at.ply.gg:7777

Attributes

delay
1
install
true
install_file
WIndows.exe
install_folder
%AppData%

aes.plain

Signatures

Async RAT payload 1 IoCs

resource	yara_rule
sample	family_asyncrat

Asyncrat family
asyncrat

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
Api-AutoUpdater.exe

Files

Api-AutoUpdater.exe
.exe windows:4 windows x86 arch:x86

f34d5f2d4577ed6d9ceec516c1f5a744

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE

Imports

mscoree

_CorExeMain

Sections

.text
Size: 58KB - Virtual size: 58KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 3KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ