Behavioral task
behavioral1
Sample
Notepad+++.exe
Resource
win7-20240729-en
General
-
Target
Notepad+++.exe
-
Size
176KB
-
MD5
e811a2eea76cc805e26501c13ce781e4
-
SHA1
9588e37dbdaf367882202067b56a8b89550f16f4
-
SHA256
04f2eadb4cf1c2aa1748467be02e801bb3236d0b1cb4ee22edb01eb12abe0dd3
-
SHA512
a4d58e513d00543767d37a571e5f4a5b923a72d7963cc65f138c28c580854fc74a9e3fdad08102b2630f0ded48be01446132477c4ec211848bd9f201f692ccaf
-
SSDEEP
3072:LuLMTwip2wiMf3bjww24LZGjXpoGoByXPQs2UTXQ8yb7aFcUiSIvF68fJvx:LuLCs/E3bQ4ZGbpYByPT7lyvIcdSIvFX
Malware Config
Extracted
asyncrat
0.5.8
Default
127.0.0.1:6606
127.0.0.1:7707
127.0.0.1:8808
2MadfT525Jmp
-
delay
3
-
install
true
-
install_file
epicgames.exe
-
install_folder
%AppData%
Signatures
Files
-
Notepad+++.exe.exe windows:4 windows x86 arch:x86
f34d5f2d4577ed6d9ceec516c1f5a744
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
mscoree
_CorExeMain
Sections
.text Size: 42KB - Virtual size: 41KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 133KB - Virtual size: 133KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ