Behavioral task
behavioral1
Sample
2024-12-16_3319633e286dc7e8f4404f9843054947_asyncrat_avoslocker_luca-stealer.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
2024-12-16_3319633e286dc7e8f4404f9843054947_asyncrat_avoslocker_luca-stealer.exe
Resource
win10v2004-20241007-en
General
-
Target
2024-12-16_3319633e286dc7e8f4404f9843054947_asyncrat_avoslocker_luca-stealer
-
Size
1020KB
-
MD5
3319633e286dc7e8f4404f9843054947
-
SHA1
d457424e6cd08e833bee4074044ec95a25b87e62
-
SHA256
9e0ef658fa66e572a25e81d23bef38b6dfba48d47fd6aa8f890ae793637a9d46
-
SHA512
b2dd78ef51b2dce34b13ad6aaf32c89b51d90a5ec8204ee4ea4f4088349d00fe23430052f40a4feb1098c7349a7d428922a65a894fbc3ecfb98c94f30dc43684
-
SSDEEP
24576:4gQ7wCw8QIxgAjwYhWaM8hYFSOKb1WQIVrgfbcT:o7wCwKxgAUYhWaM8hYI/IVczcT
Malware Config
Signatures
-
Async RAT payload 1 IoCs
resource yara_rule sample family_asyncrat -
Asyncrat family
-
StormKitty payload 1 IoCs
resource yara_rule sample family_stormkitty -
Stormkitty family
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 2024-12-16_3319633e286dc7e8f4404f9843054947_asyncrat_avoslocker_luca-stealer
Files
-
2024-12-16_3319633e286dc7e8f4404f9843054947_asyncrat_avoslocker_luca-stealer.exe windows:4 windows x86 arch:x86
f34d5f2d4577ed6d9ceec516c1f5a744
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
mscoree
_CorExeMain
Sections
.text Size: 860KB - Virtual size: 856KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 152KB - Virtual size: 148KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 4KB - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ