Overview

overview

10

Static

static

10

0x00080000...13.exe

windows7-x64

10

0x00080000...13.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    0x00080000000174cc-13.dat

  • Size

    74KB

  • MD5

    5b43e7355fd90aff498f34f9c9abe5a0

  • SHA1

    ced829ab27f09bb9316a95617e027dfa052f0955

  • SHA256

    235acf44d2a24f518dc53f3eda92ffb9fbe2546c37d9e5fb951eb282c782f3c7

  • SHA512

    a703c4e821e40361b1da8a1687fbb7e394efa81c19e386f0037b1380e1949f58219cf0b69e8ec1eee068a7cf5667c933437a3382e2f1cc9f20b438df3b35a5c0

  • SSDEEP

    1536:mU5gcxbVzCt+PPMVFsg/IuH1bG/eASUDUxQzcKLVclN:mUGcxblTPPMVFjDH1bGRNUxQ7BY

Score
10/10
ratdefaultasyncrat

Malware Config

Extracted

Family

asyncrat

Version

Tsurugi RATs

Botnet

Default

C2

213.136.90.188:4449

Mutex

zteprqyjlfgxrxuaid

Attributes
  • delay

    1

  • install

    true

  • install_file

    Check Windows Update.exe

  • install_folder

    %AppData%

aes.plain

Signatures

  • Async RAT payload 1 IoCs
    rat
  • Asyncrat family
    asyncrat
  • Unsigned PE 1 IoCs

    Checks for missing Authenticode signature.

Files

  • 0x00080000000174cc-13.dat
    .exe windows:4 windows x86 arch:x86

    f34d5f2d4577ed6d9ceec516c1f5a744


    Headers

    Imports

    Sections