asyncrat | MulitiTool[.]exe | Triage

Sharing

General

Target

MulitiTool.exe
Size

63KB
MD5

867d3df9508a810a4b6498db145508ce
SHA1

f7321cd91e4de91b7da39d5a2d25f126a77f6eb0
SHA256

bab521830c4069c60079884232777609ad392d385f323981eefb2c949a55d41b
SHA512

06e039153a01549534b62efb8e9a4d0bc57bc22b050a9822edf5cf42d2c77400657f73fd4ea4a9632e0cbb62d638e9983adaecd180d9d9835093c2874ad51712
SSDEEP

1536:HeQPcppS/QdATajykrW+UYUbZ39jLayBuIdpqKmY7:HeDqomYUbZZ1Gz

Score

10^/10

rat default asyncrat

Malware Config

Extracted

Family

asyncrat

Botnet

Default

C2

comment-mar.gl.at.ply.gg:7052

Attributes

delay
1
install
true
install_file
regedit.exe
install_folder
%AppData%

aes.plain

Signatures

Async RAT payload 1 IoCs

Processes:

resource	yara_rule
sample	family_asyncrat

Asyncrat family
asyncrat

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

Processes:

resource
MulitiTool.exe

Files

MulitiTool.exe
.exe windows:4 windows x86 arch:x86

f34d5f2d4577ed6d9ceec516c1f5a744

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE

Imports

mscoree

_CorExeMain

Sections

.text
Size: 58KB - Virtual size: 58KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 3KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ