Behavioral task
behavioral1
Sample
AsyncClient.exe
Resource
win7-20240903-en
General
-
Target
AsyncClient.exe
-
Size
72KB
-
MD5
4e6add4d01c71b6da1b1ef92ece5e4d9
-
SHA1
119c4d128e6a0bc216d724de3cae474b236be3a9
-
SHA256
f383a6ec81b2cc2c6f76d35d63c6d63e927e52d4b35e7fe4e1974eda71fe3331
-
SHA512
002e6b5665cd901eeb4ad21271dc59ba2b028ef234d41c4f391a08f3c7d7da58f1ce4645c78b7d015ed9c967a0fb0fab6489df8d12f6edeedcb991d97724238d
-
SSDEEP
1536:Qum81TQq72dKTkDy3bCXSNqEoldZeZ5/EAH5Bx:QumoTQq72dskDy3bCZ5lHoltHPx
Malware Config
Extracted
asyncrat
0.5.8
Default
127.0.0.1:6606
127.0.0.1:7707
127.0.0.1:8808
192.168.40.78:6606
192.168.40.78:7707
192.168.40.78:8808
2MadfT525Jmp
-
delay
3
-
install
true
-
install_file
epicgames.exe
-
install_folder
%AppData%
Signatures
Files
-
AsyncClient.exe.exe windows:4 windows x86 arch:x86
f34d5f2d4577ed6d9ceec516c1f5a744
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
mscoree
_CorExeMain
Sections
.text Size: 42KB - Virtual size: 41KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 29KB - Virtual size: 28KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ