Analysis
-
max time kernel
29s -
max time network
31s -
platform
windows10-2004_x64 -
resource
win10v2004-20250410-en -
resource tags
-
submitted
21/04/2025, 23:38
General
-
Target
async_modified/AsyncRAT.exe
-
Size
6.1MB
-
MD5
2e22d85e49e70fdcb2b516fc2431ed52
-
SHA1
dd3384e996b35c7a4f97696246b12d11d400f595
-
SHA256
9588fa3988ffa70c288f0566fffe1e219c0936d5af6dce5ec8b9e1b5161331bc
-
SHA512
27a81170f25e5f2bb2222669e00b9fc267a15b7b2a51143cec7d4af1475bed145fedeede038d82bf2d7bc197e8caba2a54ebeca741ed3d7d7d231f1c4374d6ae
-
SSDEEP
196608:mxeAwpZllbJwIwOA3x/6txY0h1L4EB3zDG1w:nZllnwXcth1kWjOw
Score
7/10
Malware Config
Signatures
-
.NET Reactor proctector 1 IoCs
Detects an executable protected by an unregistered version of Eziriz's .NET Reactor.
-
Suspicious behavior: EnumeratesProcesses 27 IoCs
-
Suspicious use of FindShellTrayWindow 1 IoCs
-
Suspicious use of SendNotifyMessage 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\async_modified\AsyncRAT.exe"C:\Users\Admin\AppData\Local\Temp\async_modified\AsyncRAT.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
-
C:\Windows\system32\wbem\WmiApSrv.exeC:\Windows\system32\wbem\WmiApSrv.exe1⤵
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
8KB
-
Filesize
6.1MB
-
Filesize
10.8MB
-
Filesize
2.3MB
-
Filesize
10.8MB
-
Filesize
6.8MB
-
Filesize
10.8MB
-
Filesize
10.8MB
-
Filesize
8KB
-
Filesize
10.8MB
-
Filesize
10.8MB
-
Filesize
10.8MB
-
Filesize
72KB
-
Filesize
2.5MB
-
Filesize
40KB
-
Filesize
10.8MB