AsyncRAT 3LOSH Mod.7z
- SHA256 5e7d3a1bd3c5d7ef64712823747b750983a6a67b7ded712700c9852c84fe2257
Password
infected
Behavioral task
behavioral1
Sample
AsyncRAT/AsyncRAT.exe
Resource
win10v2004-20251016-en
windows10-2004-x64
29 signatures
300 seconds
General
- Target AsyncRAT 3LOSH Mod.7z
- Size 24.6MB
- Sample251029-pwffraypaw
- SHA256 5e7d3a1bd3c5d7ef64712823747b750983a6a67b7ded712700c9852c84fe2257
- MD5 dacb5bc11693ffcec0f5160bf6518eb5
- SHA1 9ed70511a537b7b622b15f62fdcfe121b2fee71a
- SHA512 64fe99c48c76629964c3527aa180f6def895040a015f62d48a7a1ddd50e5bd3033df1f138e35d9aa47301311ec23152a936e9daf676c8b616df47f5bad5a1a81
- SSDEEP 786432:emdhVFohpr2A6LKXQcXv+9kTNF5iws7oplp52LMnVu:ndwr2A6LKVbvs7oplxu
- MD5 SHA1 SHA512 SSDEEP
Malware Config
Signatures
- Async RAT payload 1 IoCs
resource yara_rule static1/unpack001/AsyncRAT/Stub/Stub.exe family_asyncrat - Asyncrat family
- Contains code to disable Windows Defender 1 IoCs
A .NET executable tasked with disabling Windows Defender capabilities such as realtime monitoring, blocking at first seen, etc.
resource yara_rule static1/unpack001/AsyncRAT/Plugins/Extra.dll disable_win_def - Detected Nirsoft tools 3 IoCs
Free utilities often used by attackers which can steal passwords, product keys, etc.
resource yara_rule static1/unpack001/AsyncRAT/Plugins/FPLCookies.dll Nirsoft static1/unpack001/AsyncRAT/Plugins/Wallets.dll Nirsoft static1/unpack001/AsyncRAT/Plugins/WebBrowserPass.dll Nirsoft - NirSoft WebBrowserPassView 2 IoCs
Password recovery tool for various web browsers
resource yara_rule static1/unpack001/AsyncRAT/Plugins/Wallets.dll WebBrowserPassView static1/unpack001/AsyncRAT/Plugins/WebBrowserPass.dll WebBrowserPassView - Unsigned PE 35 IoCs
Checks for missing Authenticode signature.
resource unpack001/AsyncRAT/AsyncRAT.exe unpack001/AsyncRAT/BackProxyUI.exe unpack001/AsyncRAT/Plugins/AVRemoval.dll unpack001/AsyncRAT/Plugins/All-In-One.dll unpack001/AsyncRAT/Plugins/BackProxy.dll unpack001/AsyncRAT/Plugins/Chat.dll unpack001/AsyncRAT/Plugins/ChromiumCookies.dll unpack001/AsyncRAT/Plugins/DicordTokens.dll unpack001/AsyncRAT/Plugins/DotNetZip.dll unpack001/AsyncRAT/Plugins/Extra.dll unpack001/AsyncRAT/Plugins/FPLCookies.dll unpack001/AsyncRAT/Plugins/FileManager.dll unpack001/AsyncRAT/Plugins/FileSearcher.dll unpack001/AsyncRAT/Plugins/Getscreen.dll unpack001/AsyncRAT/Plugins/Hidden Anydesk.dll unpack001/AsyncRAT/Plugins/LimeLogger.dll unpack001/AsyncRAT/Plugins/Miscellaneous.dll unpack001/AsyncRAT/Plugins/Net35.dll unpack001/AsyncRAT/Plugins/Options.dll unpack001/AsyncRAT/Plugins/ProcessManager.dll unpack001/AsyncRAT/Plugins/Recovery.dll unpack001/AsyncRAT/Plugins/RemoteCamera.dll unpack001/AsyncRAT/Plugins/RemoteDesktop.dll unpack001/AsyncRAT/Plugins/SQLite.Interop.dll unpack001/AsyncRAT/Plugins/SendFile.dll unpack001/AsyncRAT/Plugins/SendMemory.dll unpack001/AsyncRAT/Plugins/UACOFF.dll unpack001/AsyncRAT/Plugins/WDExclusion.dll unpack001/AsyncRAT/Plugins/Wallets.dll unpack001/AsyncRAT/Plugins/WebBrowserPass.dll unpack001/AsyncRAT/Plugins/gcapi.dll unpack001/AsyncRAT/Plugins/x64/SQLite.Interop.dll unpack001/AsyncRAT/Plugins/x86/SQLite.Interop.dll unpack001/AsyncRAT/Stub/Stub.exe unpack001/AsyncRAT/proxlib.dll
File Explorer
-
AsyncRAT 3LOSH Mod.7z.7z 24.6MB
-
AsyncRAT/AsyncRAT.exe.exe 7.1MB
-
AsyncRAT/AsyncRAT.exe.config.xml 6KB
-
AsyncRAT/BackProxyUI.exe.exe 231KB
-
AsyncRAT/BackProxyUI.exe.config.xml 163B
-
AsyncRAT/BackProxyUI.pdb43KB
-
AsyncRAT/FastColoredTextBox.xml.xml 132KB
-
AsyncRAT/Fixer.bat141B
-
AsyncRAT/Plugins/AVRemoval.dll.dll 2.0MB
-
AsyncRAT/Plugins/All-In-One.dll.dll 5.3MB
-
AsyncRAT/Plugins/AnyDesk.exe.exe 3.8MB
-
AsyncRAT/Plugins/BackProxy.dll.dll 122KB
-
AsyncRAT/Plugins/Chat.dll.dll 107KB
-
AsyncRAT/Plugins/ChromiumCookies.dll.dll 644KB
-
AsyncRAT/Plugins/ChromiumCookies.pdb199KB
-
AsyncRAT/Plugins/DicordTokens.dll.dll 61KB
-
AsyncRAT/Plugins/DotNetZip.dll.dll 165KB
-
AsyncRAT/Plugins/Extra.dll.dll 108KB
-
AsyncRAT/Plugins/FPLCookies.dll.dll 522KB
-
AsyncRAT/Plugins/FPLCookies.pdb199KB
-
AsyncRAT/Plugins/FPLCookies.xml1KB
-
AsyncRAT/Plugins/FileManager.dll.dll 127KB
-
AsyncRAT/Plugins/FileSearcher.dll.dll 185KB
-
AsyncRAT/Plugins/Getscreen.dll.dll 4.9MB
-
AsyncRAT/Plugins/Hidden Anydesk.dll.dll 1.8MB
-
AsyncRAT/Plugins/LimeLogger.dll.dll 104KB
-
AsyncRAT/Plugins/Miscellaneous.dll.dll 241KB
-
AsyncRAT/Plugins/Net35.dll.dll 68KB
-
AsyncRAT/Plugins/Newtonsoft.Json.xml.xml 548KB
-
AsyncRAT/Plugins/Options.dll.dll 112KB
-
AsyncRAT/Plugins/ProcessManager.dll.dll 102KB
-
AsyncRAT/Plugins/Recovery.dll.dll 476KB
-
AsyncRAT/Plugins/RemoteCamera.dll.dll 164KB
-
AsyncRAT/Plugins/RemoteDesktop.dll.dll 122KB
-
AsyncRAT/Plugins/SQLite.Interop.dll.dll 1.2MB
-
AsyncRAT/Plugins/SendFile.dll.dll 106KB
-
AsyncRAT/Plugins/SendMemory.dll.dll 108KB
-
AsyncRAT/Plugins/System.Data.SQLite.dll.config.xml 736B
-
AsyncRAT/Plugins/System.Data.SQLite.xml.js .xml 1.1MB
-
AsyncRAT/Plugins/System.IO.Compression.FileSystem.xml36KB
-
AsyncRAT/Plugins/UACOFF.dll.dll 74KB
-
AsyncRAT/Plugins/WDExclusion.dll.dll 79KB
-
AsyncRAT/Plugins/Wallets.dll.dll 869KB
-
AsyncRAT/Plugins/WebBrowserPass.dll.dll 457KB
-
AsyncRAT/Plugins/desktop.ini574B
-
AsyncRAT/Plugins/gcapi.dll.dll 385KB
-
AsyncRAT/Plugins/symbols.map81KB
-
AsyncRAT/Plugins/x64/SQLite.Interop.dll.dll 1.6MB
-
AsyncRAT/Plugins/x86/SQLite.Interop.dll.dll 1.2MB
-
AsyncRAT/ServerCertificate.p124KB
-
AsyncRAT/Stub/Stub.exe.exe 56KB
-
AsyncRAT/Stub/Stub.exe.config.xml 161B
-
AsyncRAT/Vestris.ResourceLib.xml.xml 293KB
-
AsyncRAT/dnlib.xml.xml 1.7MB
-
AsyncRAT/proxlib.dll.dll 56KB
AsyncRAT/AsyncRAT.exe
- IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
- SHA256 c51a0017762a31bda284c235eb470b46810c177ee785624bef75cff9bbc3f062
- MD5 d974876918c358db7b356403a21a674e
- SHA1 c0056644d00aeb9f3e2267d803fe7a8b87ebfe65
- SHA512 449660d5bc3478c3a69594421b4adf404354841762f2a677c9f018d5c76dbc5bd23cbbaa9d31371531ac829f999d362ce7773812085b783805e71932b38d2a9b
- SSDEEP 98304:tPwbPmDVa3VxobFqjEGu/N5xXhAqin1p0T+Srp46xJJ33Je2mCrPkwy0PyK8:tY7aI7jEG2N5htin+f3HJDNsc6K
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Password
infected
Minor OS version
0
Major OS version
4
Entry point
7407774
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB paths
mscoree
_CorExeMain
Name
.text
Size
7.1MB
Virtual Size
7.1MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
31KB
Virtual Size
30KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
AsyncRAT/AsyncRAT.exe.config
- SHA256 217bdc6e5bca934ebb95c5f949102601a0342abdef29e89ae85525b8b6469151
- MD5 d0274b3a4f61365313b83d24aab060f7
- SHA1 78a08d31208ee86be12427df8d5ff6037c97413f
- SHA512 1a6a188ae233e4d7aa63ba11f3960ed04ce209e77e605a63d69e2ee8af820adcc08b3b45da6d2b6f2dd75f3054c87421a6d29cc3eff4696370ab271cc3ecb54b
- SSDEEP 192:ur7S717krAK1yd9CGoKS/pv7sJ+J/qJvS:uXS717a1ECXSS
- MD5 SHA1 SHA512 SSDEEP
AsyncRAT/BackProxyUI.exe
- IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
- SHA256 d630ae5124efd992a37026a7a68582ab56ecb2b35312c0746031a9ed8ffd3533
- MD5 bcc970d6827f8443905b020baabb19c6
- SHA1 b34370ab138cc82985a68785710b20cf78640ae6
- SHA512 cb12bcec29a209d01486008bd41adb6f2b5020547404e92da37efe4e8385a33de33222cd4352a93b7d5733eadbcf4e07233b75e89ed16c8ef4f5f04fec9b52ca
- SSDEEP 768:0s8veU5nDGOaUppAHdVnEcxV+w4ITc79OiDGOaUppAHdVnEcxV+w4Ihc77U7:B87DGOtmHTR49fDGOtmHTR4LM
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Password
infected
Minor OS version
0
Major OS version
4
Entry point
131394
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB paths
C:\Users\c 0\Desktop\اسيانس رات 2023\اسيانس رات 2023\BackProxyUI\obj\x86\Release\BackProxyUI.pdb
mscoree
_CorExeMain
Name
.text
Size
120KB
Virtual Size
120KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
110KB
Virtual Size
109KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
AsyncRAT/BackProxyUI.exe.config
- SHA256 97f54f7cda9454d4083f240408cd315a54c99be0d770f3a77baa18b00a410c8a
- MD5 9a3d99ab612161dfe2116f5939b8bc05
- SHA1 a0f4570011c4e5add32b247889eb1036c9f1cfa1
- SHA512 4701a79ae88d0164c87930d35fc3e2ebab016e6bb7ea794f90b67268782b298ab65288b8364afcaadb5c4ce6b22630179426f5a53da60dde81cb6c90a88d8590
- MD5 SHA1 SHA512
AsyncRAT/BackProxyUI.pdb
- SHA256 b97c2a6b41d1d397deebc500fc103849a742cac3d748f7f37e77a804f81ffa23
- MD5 4e561274baccb1365661959fcd574861
- SHA1 0b48ecd6d7ef97eb0488cfffc7a7783002faa54d
- SHA512 df09c90a64abfcb2a53a018bd63ea6ecd74764a7c960884759571db352d5ead029c1bbabb6294f5461cf474a69f88508a0efee54724fee56059de1b90a40cb7e
- SSDEEP 384:6wRSRzsrcKrTkEZ76fIEZ7at/XENrwI+DYVeOesrcKXTkn+eO:6wRSRzsrcKv4D+AusrcKDk+
- MD5 SHA1 SHA512 SSDEEP
AsyncRAT/FastColoredTextBox.xml
- SHA256 f3f2e537065317b6ce66dac64042e925bbcea65f00561f9860b7172c9ca07027
- MD5 70d49dec6a333f1d94fb1e77c663525c
- SHA1 184b544e672f4c4cb9ed9cf010da568eed16623d
- SHA512 b78a3c4418a7c5014eb16e72f2113f00353e9e566942f7160067c826c47f1ec2752ae7ede796fc159fb9bae499d347f822401fbc4446e2556cbd680cd595c2e2
- SSDEEP 1536:45SVw7sekyF7o//t3zEzacGE5xa5lIV1/P5:45Sm7sekyxo//xzEz3GlM
- MD5 SHA1 SHA512 SSDEEP
AsyncRAT/Fixer.bat
- SHA256 5255fa89ba49c5f1f2c81d66d42e3b16305296945683954eab1492ed11b90b4c
- MD5 52ab2690a33a51804764be81820504aa
- SHA1 36af53e8b27ea737c255402156c77c5f9be17aa0
- SHA512 95579203bd7e3f2104ad2f886b162f9938d6e371ba351b0b9c5fb5d3368d674f22f4c2ccc54aece5a9ab5f044ca9deeed63a4ad30ffd42787c54807c8396f21b
- MD5 SHA1 SHA512
AsyncRAT/Plugins/AVRemoval.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 187b89f666ab9c8b0fb70fab8b94ae452dfb18af56b0ce394bdec50f2eee1d8d
- MD5 2ceee07f54f77c5306305360cdab0680
- SHA1 ea0f13aca4bec523845d6f9c014bb730987582b1
- SHA512 f41ebc91596a92ff6d19eb6a8b8fdf1d2e5183e12fd0e678e244d679e44490f12b0ef7f218cd855060da66f734bdacd9a7fe46a78c4c5a3a18ede723ddaa82af
- SSDEEP 49152:42YmD2APT6Mhg8f7eNPP5YyElKjh+l9TfBJbL3B1:4qT6MhhqQPgiz9LR1
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Password
infected
Minor OS version
0
Major OS version
4
Entry point
2062094
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
mscoree
_CorDllMain
Name
.text
Size
2.0MB
Virtual Size
2.0MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
884B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
AsyncRAT/Plugins/All-In-One.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 7b50ea103b15677e9d317a1229759112e89ce8f69de096d3807ae4f66ec871ce
- MD5 c5525f1cd7aff0ebc201aad7370095b0
- SHA1 c31e834c9396ce97f0b19132af4cd49aa5f5693b
- SHA512 c2ab0a3b29fbf4232e55e71ab0cd1e88aaa088cd4f63c0fe0fedd2ed7872f985470cbbf7de88b690e3d96db83b1ae1c598f47ce94e1487a42a5e63a931e7e841
- SSDEEP 98304:k5qvPBOw0JefVfQ2a5cFd4KssODtdjF9QORkChiDC9OtH7c2iwGxB1:k5qnz0kfVo26WsdjFPRkC8C9OH7c2ilf
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Password
infected
Minor OS version
0
Major OS version
4
Entry point
5539454
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
mscoree
_CorDllMain
Name
.text
Size
5.3MB
Virtual Size
5.3MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
900B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
AsyncRAT/Plugins/AnyDesk.exe
- SHA256 580f6a285c6c3b7238bd16e1aeb62a077ae44b5061a2162e9fd6383af59028bb
- MD5 fe61cd9e702ec1208c13350c00f0732c
- SHA1 379520c1ad0541d5a30f214e15b7c8bff6766f9f
- SHA512 504e581026719b31555f0131bbaf9d5655c8955d9382cc53688873295d393028987032bdfccef09cf42e16ea51f8f8bf91543585b2754d5827d7b29325540cab
- SSDEEP 98304:RSExf+1CnXTxQ9LDj6eblG+L9nDHPdQod:RScf+8nXdQvPtL97dPd
- MD5 SHA1 SHA512 SSDEEP
Password
infected
Digest
dd:61:39:95:79:fd:39:15:f4:64:5f:9a:81:af:d2:79:93:e7:0c:4f:69:d5:54:1b:5b:0c:3a:50:5e:1a:21:8b
Digest Algorithm
sha256
PE Digests Matches
Trusted
Signing Certificate
CN=philandro Software GmbH,O=philandro Software GmbH,L=Stuttgart,ST=Baden-Württemberg,C=DE
Chains
Dec 20, 2022
CN=philandro Software GmbH,O=philandro Software GmbH,L=Stuttgart,ST=Baden-Württemberg,C=DE
CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US
CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US
CN=philandro Software GmbH,O=philandro Software GmbH,L=Stuttgart,ST=Baden-Württemberg,C=DE
CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US
CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US
CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Digest
a5:45:4c:31:da:9a:39:ff:f1:18:dc:f7:a1:11:15:b8:5d:88:c6:57
Digest Algorithm
sha1
PE Digests Matches
Trusted
Signing Certificate
CN=philandro Software GmbH,O=philandro Software GmbH,L=Stuttgart,ST=Baden-Württemberg,C=DE
Chains
Dec 20, 2022
CN=philandro Software GmbH,O=philandro Software GmbH,L=Stuttgart,ST=Baden-Württemberg,C=DE
CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US
CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US
CN=philandro Software GmbH,O=philandro Software GmbH,L=Stuttgart,ST=Baden-Württemberg,C=DE
CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US
CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US
CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Subject
CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US
Serial Number
0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a
Issuer
CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Aug 1, 2022 - Nov 9, 2031
Subject
CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US
Serial Number
07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b
Issuer
CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Mar 23, 2022 - Mar 22, 2037
Subject
CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US
Serial Number
08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9
Issuer
CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Apr 29, 2021 - Apr 28, 2036
Subject
CN=DigiCert Timestamp 2022 - 2,O=DigiCert,C=US
Serial Number
0c:4d:69:72:4b:94:fa:3c:2a:4a:3d:29:07:80:3d:5a
Issuer
CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Sep 21, 2022 - Nov 21, 2033
Subject
CN=philandro Software GmbH,O=philandro Software GmbH,L=Stuttgart,ST=Baden-Württemberg,C=DE
Serial Number
0d:bf:15:2d:ea:f0:b9:81:a8:a9:38:d5:3f:76:9d:b8
Issuer
CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Dec 13, 2021 - Jan 8, 2025
Subject
CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US
Serial Number
08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9
Issuer
CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Apr 29, 2021 - Apr 28, 2036
Subject
CN=philandro Software GmbH,O=philandro Software GmbH,L=Stuttgart,ST=Baden-Württemberg,C=DE
Serial Number
0d:bf:15:2d:ea:f0:b9:81:a8:a9:38:d5:3f:76:9d:b8
Issuer
CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Dec 13, 2021 - Jan 8, 2025
Subject
CN=Symantec SHA256 TimeStamping CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US
Serial Number
7b:05:b1:d4:49:68:51:44:f7:c9:89:d2:9c:19:9d:12
Issuer
CN=VeriSign Universal Root Certification Authority,OU=VeriSign Trust Network+OU=(c) 2008 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US
Key Usages
KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Jan 12, 2016 - Jan 11, 2031
Subject
CN=Symantec SHA256 TimeStamping Signer - G3,OU=Symantec Trust Network,O=Symantec Corporation,C=US
Serial Number
7b:d4:e5:af:ba:cc:07:3f:a1:01:23:04:22:41:4d:12
Issuer
CN=Symantec SHA256 TimeStamping CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Dec 23, 2017 - Mar 22, 2029
Minor OS version
1
Major OS version
5
Entry point
7401
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE
PDB paths
C:\Buildbot\ad-windows-32\build\release\app-32\win_loader\AnyDesk.pdb
Name
.text
Size
10KB
Virtual Size
10KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.itext
Size
Virtual Size
12.6MB
Characteristics
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rdata
Size
1024B
Virtual Size
762B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
3.8MB
Virtual Size
3.8MB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
18KB
Virtual Size
18KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
1024B
Virtual Size
768B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=8, id=171, productName=VS2010 build 30319, version=30319,
count=3, id=170, productName=VS2010 build 30319, version=30319,
count=1, id=154, productName=VS2010 SP1 build 40219, version=40219,
count=1, id=157, productName=VS2010 build 30319, version=30319,
AsyncRAT/Plugins/BackProxy.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 1118bf5248bbb4ae85b2bac9f8ebfd4d2868fd4a86d6b60c98ffcb1f53542c15
- MD5 a21c7e6ca09b90b27e8a32c14d16a794
- SHA1 a330a73ef0f39b1dad64a40bb67c6d701e1c356f
- SHA512 7f0125e6bea524f046f5aafb09e2f369d877fe1a23d116ff94dae5f965ced09af3a006e1c36d5d8209fd1de44ae205b45de7298c6f0bae1fc5cfb7003a3e1731
- SSDEEP 1536:Dg5KW/oS3susxOxFJEoLnRMVumNRH4HeTtrACX0HF5if0oyQP27cGCNK:csXS3oQpE4OJNRHBvCo0F7B
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Password
infected
Minor OS version
0
Major OS version
4
Entry point
130814
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
mscoree
_CorDllMain
Name
.text
Size
120KB
Virtual Size
119KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
884B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
AsyncRAT/Plugins/Chat.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 54904fdd5e3dd03dc967c56c422c68924beb7cd69ca969ab5245ae919acc9184
- MD5 04bd288c4586ca19e677033215b92d26
- SHA1 52abda29696d1ea8146053c916119da1e159e751
- SHA512 f593be9524d6d4346f2fd7bb93a6ccc67c155daca0eae20fed0832b99c265700dad9d5584f5e1b9f20e52ec968ce03943d9667fa5546a9d09ffa23a62b7d77a7
- SSDEEP 1536:wvIqSb8vsWt6wZgvOt5SKNGUJq+FnD45KNrfXiRgKOmbvNUzT8JlF:vbOxVt5pYUMwooDiZbVjJ3
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Password
infected
Minor OS version
0
Major OS version
4
Entry point
116014
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
mscoree
_CorDllMain
Name
.text
Size
105KB
Virtual Size
105KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
804B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
AsyncRAT/Plugins/ChromiumCookies.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 4a0857feea93ed57811c27ee32b27f677610911e61914d63504936aa5f65182c
- MD5 180f56f065ae8fa8470e69144ff7ceaa
- SHA1 c9d85e14675fdaef68b2b1b92c34661327cefbfa
- SHA512 0e37a59717090db4e97b4c559a84d8e2e2553bcb8518b74c3a347a964d5145f02124c6455228a0ecca2fd6a15071ef5780198f7ef52d463ba8c92018b916edd4
- SSDEEP 12288:hA9ND6xZomTQvv1LULCTFu66k9r1aaC7KEjKR:hAXOxZogQNu6ZrvCWEI
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Password
infected
Minor OS version
0
Major OS version
4
Entry point
665438
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
ChromiumCookies.pdb
mscoree
_CorDllMain
Name
.text
Size
642KB
Virtual Size
641KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
932B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
AsyncRAT/Plugins/ChromiumCookies.pdb
- SHA256 eb690207386392c4321698ca7b1169c129f8f387a256255dba5e7e5668c6352e
- MD5 006b20c2c015ce66b02e43ec56180ea0
- SHA1 0a000f20e9d8b4cb325f870f77b989c324285bf4
- SHA512 fe0d933aec3b987fea44b9ce352cb1b3fffbe3f0f3645d99a2a600f5932fc403afda48c5d1fb092fbe6343ade1f34e7a8284cee69c5f9f5ba88a89d36ed5cdd3
- SSDEEP 3072:/GTWfRaIU8+lox7P0yAqsR+hpq+wuvoYdBrhqY2:uitWloJZH5voqr8Y2
- MD5 SHA1 SHA512 SSDEEP
AsyncRAT/Plugins/DicordTokens.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 1be965f4cba5a520d23f468b1b2c125c49f7e11223797a4e49345f819c2e714b
- MD5 e30a13d61f42481f2010553fa9e1ff36
- SHA1 dba90563289a29af3ef915e13e9a69b5d9daa5d9
- SHA512 922546a4082a9feae6b416b965016aa9fcdacdda1d3e7af8139195888624eb33aae177b42d0dada4b3742faab3a3bc1f3bffd7955173bbd66b837842b0056de0
- SSDEEP 768:KuAXSFmvTAZwWCgq6517X3aA4ZU3m95E9xOH8k8ScjquT9vdBoDHSm/NTDAHb/vn:Ku3F0cZwJZY1BsEASUpDQ/PQR/It7j
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
68094
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
mscoree
_CorDllMain
Name
.text
Size
59KB
Virtual Size
58KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
916B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
AsyncRAT/Plugins/DotNetZip.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 2cc31edcb6a5fe043f5aaeffa13f81eab05a0a5e3d08a2fc04beaa37cd65abb6
- MD5 050de1b527dd6693006cb92a241d9752
- SHA1 b24bfb87d146e1b810176cdbecfefd1d0ea4454f
- SHA512 4bd49fdf611110ceabc3c1076b2690440d139836bfd5f69af0697dcab67248f191056676468408d269e07b01e9281d14bf0dfbcd6117052bd6454f20b301e8ac
- SSDEEP 3072:N6T/gqXKq8KVCx80ARiPlq9IWUY1jXLY+Vw56ctHGRPeI/Kh73WmqcSCJLeKg2XP:Nc/gqXKq8+RigIWU+Ydm0UA
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
165662
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
C:\Users\admin\source\repos\ОбглодышDotNetZip\ОбглодышDotNetZip\obj\Release\DotNetZip.pdb
mscoree
_CorDllMain
Name
.text
Size
163KB
Virtual Size
163KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
920B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
AsyncRAT/Plugins/Extra.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 dca1cb22916612ccee6fd06e053731b0404c861019c66bf45aad35b72cfb60e5
- MD5 1beedc34e457d082462380abe3663731
- SHA1 f049bf9e29bd552230028770ee0646f92ebb2a5e
- SHA512 3f98cdc878633f8f5ae836c42d835c32e887061e3adcfd77491a14e57aa8069cdc9e68df1c1f4117d0f098a5213a922cc933a9a1647f9a3f7f7ae0871f76f82d
- SSDEEP 1536:efkNClFLx2OYVHxiHahkbbwTUmVR2Az5jMKZLkc4OI/bJ6TI5W1ce9Pzzgk:2u0OpVRObaUm/2KV2OobJYIIjRz/
- MD5 SHA1 SHA512 SSDEEP
-
Contains code to disable Windows Defender
A .NET executable tasked with disabling Windows Defender capabilities such as realtime monitoring, blocking at first seen, etc.
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
117150
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
mscoree
_CorDllMain
Name
.text
Size
106KB
Virtual Size
106KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
804B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
AsyncRAT/Plugins/FPLCookies.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 2944bbf55682d5ddfcca621fc4115fabe06f7cd35c172a93dc21584333a98d2b
- MD5 d47e272560d80f0057a75f993a7be9f7
- SHA1 cf593dec5153d9d54678ee8f949a677460fbbcf9
- SHA512 2241aebb8b5bd49bacb6dcd5afc3897d7f91aee4e2abe01f8ce667bd67b7ebde30bea4af0dedef944d8077e513183c9adf64c6402eed6166cf7a08abc0834500
- SSDEEP 12288:G711VqOfNM9Mfuc1OgWtlTtb8iLL5LXrk7ryOUdDl:I1VqOKCuc1bMnAi35uUZl
- MD5 SHA1 SHA512 SSDEEP
-
Detected Nirsoft tools
Free utilities often used by attackers which can steal passwords, product keys, etc.
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
540958
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
FPLCookies.pdb
mscoree
_CorDllMain
Name
.text
Size
520KB
Virtual Size
520KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
900B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
AsyncRAT/Plugins/FPLCookies.pdb
- SHA256 c38a006ad144d5e4a2a8f8dd3eaa13a4732b748b95f91bfa47f7bfd4f9f6cdbf
- MD5 fdddc13d7320f457c3297b20e9c33fb6
- SHA1 8573f767a97b2b114b6e9c323a4e7263438e6a1c
- SHA512 bb9cd3a7fba406703100cba68b4bb906d9b61ac3b7f091972ca6285ed6ffdf8a7c651419b897e0046a70ecdc04dde17fa36929733773eb856e7ae87348e6c4d9
- SSDEEP 3072:BGuFM3/6jK1oqpplNwHB+hpP+wuvo/dBrrje5RraB0:r9EoqpLNGvoPrXe5ta
- MD5 SHA1 SHA512 SSDEEP
AsyncRAT/Plugins/FPLCookies.xml
- SHA256 032aedef045929ce036669fc7812a801af4e93276827ecaf2c3bf2cd590a4422
- MD5 a54cc1c077aca2e1e345db80a53cc7e9
- SHA1 c1fb3383645007cd1d0bf0d7f59e77b18eb7a988
- SHA512 ecc9bc6b844530af330ea6295d4e0ab0c5efea34b0290ab087080caa17ffebd52321617643e9918fd7f89448fd3876d948c4a0b1249def46ef1e5dcc46c3f54d
- MD5 SHA1 SHA512
AsyncRAT/Plugins/FileManager.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 f16833bfecec9aec3755dbf8b0af399d1fa0f923c63243afa75e94deb2fcfafa
- MD5 ce1d39a80ae0ec1078dfedde3f32bd16
- SHA1 c69f8e2f69880615b627dfa4140379c6606eadcb
- SHA512 b09b105e37c402de35015b390ec3f4d7099c25f0a6c225f47cd97ca515427d3b20524ede3c466af5dee35fe7ce945738b3c1b4a01b4c72aa4a9ca2bd821566e9
- SSDEEP 1536:9n7JZEgPBi1PBlzve3QNpJsbAMZlKFpGEUfW6LU6sKdbtVciyLfkemH5PQJGG:JpCG3NVZlKBU+6Bbt+iyLfkH5Id
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
136478
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
mscoree
_CorDllMain
Name
.text
Size
125KB
Virtual Size
125KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
684B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
AsyncRAT/Plugins/FileSearcher.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 7090260164ba7af24ff3eb6bad3b9f70f662fe86872a5464eaf71ea738652dd0
- MD5 2aa61fe57b0b86b4e622ed46f2b8dee8
- SHA1 fd0f6aa3159977d5cb6e8651e4e8378a45edf217
- SHA512 b7529f0f7e391780815b01ee01ed3d44fd20fdb67198ed1137e9f2023bf4521c73f60d427d7d76f65611ddff3f52366b795d245416a7f63768cde061b0b2856f
- SSDEEP 3072:nl5vboJMXWw8FWjLvGGaSHMdcvIe3NFJutuI0CSXVGB9yDXcfUUsw:ncS+QLvGHSsdqjJiulCcVWivUs
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
195694
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
mscoree
_CorDllMain
Name
.text
Size
183KB
Virtual Size
183KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
836B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
AsyncRAT/Plugins/Getscreen.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 4dd1b2618a3838dd7069b98d4a739000030473652aed39cb62ccb2ba55d494e0
- MD5 3d9c7bb8732b7b6fe132a5aad2432668
- SHA1 5b92551498b3ace09e51dc53280977416d552036
- SHA512 b0e14f33ed58b7e0aacc6fa9e91413503063d5b43edc4321c06b9e1b46b8ffdcd76640951d5a83105efdfd99667f69b6ecc79bfdc745f1adc2c8959b804fbdf6
- SSDEEP 98304:A3bfwQYhbS5dx3ekCouTcI7uJTkAB6OdaU6azxvSIMXwyE/:A35Kor3uouTc9T96OdxNauyE
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
5182638
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
mscoree
_CorDllMain
Name
.text
Size
4.9MB
Virtual Size
4.9MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
884B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
AsyncRAT/Plugins/Hidden Anydesk.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 199feabc8993d8bd50495fe5fc8c5decd0c3dbcb597a042716afb42722d1bbf9
- MD5 a749d7fff642f8ff097da220e3aec48c
- SHA1 601571cbb506ecbab1e95d3631e3e96ee0d4876d
- SHA512 93d918f3def4cb507d822f1c193e4ea17e406fe92d1101dd1215b08043944d32270906bb5b29984917acc9ec7fdcf6658cc883e0ed95056c4e95dc47b04aafa1
- SSDEEP 49152:4WXHAtLxVYV1qHFIhcX9WSeX40xG+tBQWhfIcTkiZ3:40HAtdVYV1VKXeoMGi2Whfj
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
1888046
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
mscoree
_CorDllMain
Name
.text
Size
1.8MB
Virtual Size
1.8MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
932B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
AsyncRAT/Plugins/LimeLogger.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 7eca03f80d8339d672ed8b72125783e7d29beb0d885193dcc8f5d135ca727da7
- MD5 d75666bc6f8d80c5eab43f299e0d476e
- SHA1 56b450905e19bc52a9a05b617c6fbbc4da25f687
- SHA512 464c7397fc62363dd57a56fab14ec81db16b8e34870c0354b86860cc915b3d127e0331542fade505bf8bcb141d7558d2becfd6624bacd6d0f8572934affa36a3
- SSDEEP 1536:A38AbOlDW1qVLoHYRCEA8wsgZMlhpp+umiw92jC70sC++y/CN:AnZSoSphpp+32CvC08
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
112830
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
mscoree
_CorDllMain
Name
.text
Size
102KB
Virtual Size
102KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
828B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
AsyncRAT/Plugins/Miscellaneous.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 64f4d635eafe1cd1d651eab2c9c1a6a364973c3192796a225213eb0032838017
- MD5 a9761d1b53888832681afacbc2ce3d2f
- SHA1 010617173f751ecd5255b37d40d4da6c23ffc0c0
- SHA512 210a2c0e058d90bbc6a149373d871750d2c96cbb6675a30f74bae1a19ee00b4dde2151c8aa8516cf35bddd4729a440c5584d9c44761a38f04ba27b1a780ffce0
- SSDEEP 3072:7B5BUC82kfBZWISnShRaPKXq/IDEPA0O5Cq6hd51lX0eTUZhsqllNDfu0+QQIH32:7he244I3hPZYIAXjT67Ph1fD
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
252622
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
mscoree
_CorDllMain
Name
.text
Size
239KB
Virtual Size
238KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
692B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
AsyncRAT/Plugins/Net35.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 1028140b9228b073295ab72708690a376bcee1ea80ee23f29f8c98e8697fc301
- MD5 e478f17d7a0e33b6f8d22458627f45eb
- SHA1 e550c80a804bd9a8d899a88f0da5a1372b2e6078
- SHA512 6f58816f74522d338b5eea3ac4e5acc685508846f6627420782c5f59c081e9c72611830149bfb28c05de072797de19066a26a1d12763c2ca929cdc3dcb6d5e45
- SSDEEP 768:bKTXETBFAubXNRFaFhU+hx2M3/K2Hzlnvdh6xaCKJpNAFc9f922vuMfmLc7dosJ5:Oj2xJRUF3C21F0zWZ9F22mOmo5osD1p
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
75550
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
mscoree
_CorDllMain
Name
.text
Size
66KB
Virtual Size
65KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
852B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
AsyncRAT/Plugins/Newtonsoft.Json.xml
- SHA256 39f6a4db1be658d6baff643fa05aae7809139d9665475bfca10d37dca3384f21
- MD5 928ed37db61c1e98a2831c8c01f6157c
- SHA1 98103c2133ebda28be78bfe3e2d81d41924a23ee
- SHA512 f59387bfa914c7db234161e31ad6075031aca17aaef4b8d4f4b95c78c7a6a8d0e64211566ca2fd4549b9da45231f57a4191fbcd3809404653f86ee2abd4937a4
- SSDEEP 6144:XqqUmk/Rik2rH6dl0/IaHNpOVIeR0R+CRFo9TA82m5Kj+sJjoqoyO185QyMYFLse:DUK
- MD5 SHA1 SHA512 SSDEEP
AsyncRAT/Plugins/Options.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 7e9b067f9f0beb14683ee5280df960448b71c1a0d693dab3824fa9b38eb1e7dd
- MD5 dbbcbfa34683c185f3813c3b44d3f161
- SHA1 7fb8aab820b98c6d5a14be0895ece2d420b0fee2
- SHA512 9693c44ea589d84521e8b71018d9a39e95aa2cd7aa40bddf140df8f2f5b020bfbd6fd6616efcb731fecb4bac409750d1eeeb7dd48f142b99b6c6353fb1e58cf8
- SSDEEP 1536:REO2vRszA4ny+a+BlTCk6308sPthnwzPL9eSYtUbuc3ImxQPcX:S9ma+7ftJfsL9ctUii1xQPE
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
121182
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
mscoree
_CorDllMain
Name
.text
Size
110KB
Virtual Size
110KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
812B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
AsyncRAT/Plugins/ProcessManager.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 2dae85f73bc5c917842f8708fdb4d244b7152848c1ddaaf231977bb6f73122c6
- MD5 56ee1600c89ce4c5dd76fe31f85531db
- SHA1 241c35e10e855b519693496fd260413368c6639f
- SHA512 12d6bc18402eefeca6ac5db59d292a9915954d73816170ebad25dc430cec1c314992b944b6f8423b4ff140183dc39b348b0496416d070055bd08473a8a105932
- SSDEEP 1536:u6GuGKglktnnp3CxJNoeZnp1IrGmQzvuncs5CXYc1ipDyA:uakMnnp3C5DZpKamIuncscXYc8pDZ
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
110654
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
mscoree
_CorDllMain
Name
.text
Size
100KB
Virtual Size
100KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
844B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
AsyncRAT/Plugins/Recovery.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 e955b9d776dcd24518f05aa02fb5aba8a9b5dc07f4b03d837e0889d708b0fd81
- MD5 0ee4edb6cce0045d30578284372ae1c6
- SHA1 ac03b7efff2c7e5402a09375ad5407f6181a09b0
- SHA512 20683992b5ede4d63a10de1788825df8a989f46cd3ecf7c0577560bdde79d382ccca06c838df4d401db2ad14c9f59fd69d6509c119a4e95f343012f050634004
- SSDEEP 6144:OfeyG7ajCAbUsUNKMDMAlcn38OxKl9x7qs9Pxcm0AUNy9rsx4nJzpRX1MfWEtkoh:OMWYEMDMVqfBdcmDBLJzpV1MfWERME
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
493550
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
mscoree
_CorDllMain
Name
.text
Size
474KB
Virtual Size
473KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
820B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
AsyncRAT/Plugins/RemoteCamera.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 6b896c59ab2c80ada84f6266846f8e861b2c83a8e004e1b377ab9213074526af
- MD5 e89e1d0173f23a63a6f7002a01a8d2cb
- SHA1 1d5289d9ce58f6b1767abedc1829615320b6b3f1
- SHA512 f04332f7b0e34615bc90892bba2e9ca474dabf56017d03873784a57ac93363a3fbe9c71d50f083c2d3df1bce06d99f2f1b1d0de76e0693ae85818808f152f133
- SSDEEP 3072:Lfc8XkoGXZel36cgj2vWhDcnX7v5s0kCt7HFd:Lf5GJ436cgj2vWhDcLsCt
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
173886
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
mscoree
_CorDllMain
Name
.text
Size
162KB
Virtual Size
161KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
836B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
AsyncRAT/Plugins/RemoteDesktop.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 2d02e0f29197effb024ccee5e1199d5b61b41d4467da2f9851e2f8acc318bd31
- MD5 cf43aecfa982819014408c3cdd4a4c36
- SHA1 8ce4dff2baa1a2f59dedb60aab6bfab4c051b9a0
- SHA512 9c0ac9c4cdf55d69c7c31d78ade63467cc17a995f72df9e957a952abb50e2c9089b8cb4d5f0e1420373c3050dcbd871c383cbfe80177df8cf83c6948cfe8cd33
- SSDEEP 1536:xqkv6MYDPYRsdfH3QdM/r9VKNl8qsfCN5+wDfmXzLimLhNMg7Nu:xqKa7f4MlNEmXzHLrMg7M
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
130862
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
mscoree
_CorDllMain
Name
.text
Size
120KB
Virtual Size
119KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
836B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
AsyncRAT/Plugins/SQLite.Interop.dll
- IMPHASH 43cf4064308c8cffa2acc646c51eabf0
- SHA256 ba0bf347cd8966e53efa282df84a9f966bbc2ff99642ee0be5b2a86644bb7f5e
- MD5 c09a5ff0cf2613ebcf29357be05c9bc3
- SHA1 0ed14fa706e2e46933c4dbc27c8329cd99201070
- SHA512 99eda404ec421756049f5d7fc42c27079187c6afb35ab125f4b8a8f9764687bf1777bac018ad0b7fd7640b1215f0b3a2741689ead569bec938aef428510ccaf8
- SSDEEP 24576:wFnIJ6GG4PYmGL/mnOkumid0vuP0CKJUvo6FywlapXf7bGKHu9b0D:wxIJGjmGL/SOSWP1AUsHGn0D
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
1
Major OS version
5
Entry point
10144
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
c:\dev\sqlite\dotnet\bin\2010\Win32\ReleaseNativeOnlyStatic\SQLite.Interop.pdb
kernel32
UnmapViewOfFile
SetEndOfFile
FreeLibrary
HeapAlloc
SystemTimeToFileTime
QueryPerformanceCounter
HeapFree
WaitForSingleObject
InterlockedCompareExchange
UnlockFile
FlushViewOfFile
LockFile
WaitForSingleObjectEx
OutputDebugStringW
GetTickCount
UnlockFileEx
GetProcessHeap
GetSystemTimeAsFileTime
FormatMessageA
WriteFile
InitializeCriticalSection
WideCharToMultiByte
LoadLibraryW
Sleep
FormatMessageW
GetVersionExW
HeapDestroy
LeaveCriticalSection
GetFileAttributesA
HeapCreate
MapViewOfFile
GetFileAttributesW
ReadFile
CreateFileW
MultiByteToWideChar
FlushFileBuffers
GetTempPathW
GetLastError
GetProcAddress
HeapSize
LockFileEx
EnterCriticalSection
GetDiskFreeSpaceW
LoadLibraryA
CreateFileMappingA
CreateFileMappingW
GetDiskFreeSpaceA
GetSystemInfo
GetFileAttributesExW
DeleteCriticalSection
GetCurrentThreadId
OutputDebugStringA
GetVersionExA
CloseHandle
DeleteFileW
GetCurrentProcessId
GetTempPathA
LocalFree
GetSystemTime
AreFileApisANSI
DeleteFileA
TryEnterCriticalSection
SetFilePointer
HeapCompact
CreateMutexW
GetFileSize
CreateFileA
HeapReAlloc
GetFullPathNameA
HeapValidate
GetFullPathNameW
ExitThread
CreateThread
DecodePointer
GetCommandLineA
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
IsProcessorFeaturePresent
EncodePointer
GetTimeZoneInformation
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
InterlockedIncrement
GetModuleHandleW
SetLastError
InterlockedDecrement
ExitProcess
GetCPInfo
GetACP
GetOEMCP
IsValidCodePage
LCMapStringW
SetHandleCount
GetStdHandle
InitializeCriticalSectionAndSpinCount
GetFileType
GetStartupInfoW
GetModuleFileNameA
FreeEnvironmentStringsW
GetEnvironmentStringsW
RaiseException
GetModuleFileNameW
RtlUnwind
GetStringTypeW
CompareStringW
SetEnvironmentVariableA
advapi32
CryptDestroyHash
CryptDecrypt
CryptDestroyKey
CryptCreateHash
CryptEncrypt
CryptDuplicateKey
CryptDeriveKey
CryptAcquireContextW
CryptHashData
_interop_compileoption_get@4
_interop_compileoption_used@4
_interop_libversion@0
_interop_sourceid@0
_sqlite3_backup_finish_interop@4
_sqlite3_bind_double_interop@12
_sqlite3_bind_int64_interop@12
_sqlite3_bind_parameter_name_interop@12
_sqlite3_blob_close_interop@4
_sqlite3_changes_interop@4
_sqlite3_close_interop@4
_sqlite3_column_database_name16_interop@12
_sqlite3_column_database_name_interop@12
_sqlite3_column_decltype16_interop@12
_sqlite3_column_decltype_interop@12
_sqlite3_column_double_interop@12
_sqlite3_column_int64_interop@12
_sqlite3_column_name16_interop@12
_sqlite3_column_name_interop@12
_sqlite3_column_origin_name16_interop@12
_sqlite3_column_origin_name_interop@12
_sqlite3_column_table_name16_interop@12
_sqlite3_column_table_name_interop@12
_sqlite3_column_text16_interop@12
_sqlite3_column_text_interop@12
_sqlite3_context_collcompare_interop@20
_sqlite3_context_collseq_interop@16
_sqlite3_create_disposable_module_interop@112
_sqlite3_create_function_interop@36
_sqlite3_cursor_rowid_interop@12
_sqlite3_errmsg_interop@8
_sqlite3_finalize_interop@4
_sqlite3_index_column_info_interop@32
_sqlite3_last_insert_rowid_interop@8
_sqlite3_malloc_size_interop@4
_sqlite3_memory_highwater_interop@8
_sqlite3_memory_used_interop@4
_sqlite3_msize_interop@8
_sqlite3_open16_interop@20
_sqlite3_open_interop@20
_sqlite3_prepare16_interop@24
_sqlite3_prepare_interop@24
_sqlite3_reset_interop@4
_sqlite3_result_double_interop@8
_sqlite3_result_int64_interop@8
_sqlite3_table_column_metadata_interop@44
_sqlite3_table_cursor_interop@12
_sqlite3_value_double_interop@8
_sqlite3_value_int64_interop@8
_sqlite3_value_text16_interop@8
_sqlite3_value_text_interop@8
sqlite3_activate_see
sqlite3_aggregate_context
sqlite3_aggregate_count
sqlite3_auto_extension
sqlite3_backup_finish
sqlite3_backup_init
sqlite3_backup_pagecount
sqlite3_backup_remaining
sqlite3_backup_step
sqlite3_bind_blob
sqlite3_bind_blob64
sqlite3_bind_double
sqlite3_bind_int
sqlite3_bind_int64
sqlite3_bind_null
sqlite3_bind_parameter_count
sqlite3_bind_parameter_index
sqlite3_bind_parameter_name
sqlite3_bind_pointer
sqlite3_bind_text
sqlite3_bind_text16
sqlite3_bind_text64
sqlite3_bind_value
sqlite3_bind_zeroblob
sqlite3_bind_zeroblob64
sqlite3_blob_bytes
sqlite3_blob_close
sqlite3_blob_open
sqlite3_blob_read
sqlite3_blob_reopen
sqlite3_blob_write
sqlite3_busy_handler
sqlite3_busy_timeout
sqlite3_cancel_auto_extension
sqlite3_changes
sqlite3_clear_bindings
sqlite3_close
sqlite3_close_v2
sqlite3_collation_needed
sqlite3_collation_needed16
sqlite3_column_blob
sqlite3_column_bytes
sqlite3_column_bytes16
sqlite3_column_count
sqlite3_column_database_name
sqlite3_column_database_name16
sqlite3_column_decltype
sqlite3_column_decltype16
sqlite3_column_double
sqlite3_column_int
sqlite3_column_int64
sqlite3_column_name
sqlite3_column_name16
sqlite3_column_origin_name
sqlite3_column_origin_name16
sqlite3_column_table_name
sqlite3_column_table_name16
sqlite3_column_text
sqlite3_column_text16
sqlite3_column_type
sqlite3_column_value
sqlite3_commit_hook
sqlite3_compileoption_get
sqlite3_compileoption_used
sqlite3_complete
sqlite3_complete16
sqlite3_config
sqlite3_context_db_handle
sqlite3_create_collation
sqlite3_create_collation16
sqlite3_create_collation_v2
sqlite3_create_disposable_module
sqlite3_create_function
sqlite3_create_function16
sqlite3_create_function_v2
sqlite3_create_module
sqlite3_create_module_v2
sqlite3_create_window_function
sqlite3_data_count
sqlite3_data_directory
sqlite3_db_cacheflush
sqlite3_db_config
sqlite3_db_filename
sqlite3_db_handle
sqlite3_db_mutex
sqlite3_db_readonly
sqlite3_db_release_memory
sqlite3_db_status
sqlite3_declare_vtab
sqlite3_dispose_module
sqlite3_drop_modules
sqlite3_enable_load_extension
sqlite3_enable_shared_cache
sqlite3_errcode
sqlite3_errmsg
sqlite3_errmsg16
sqlite3_errstr
sqlite3_exec
sqlite3_expanded_sql
sqlite3_expired
sqlite3_extended_errcode
sqlite3_extended_result_codes
sqlite3_file_control
sqlite3_filename_database
sqlite3_filename_journal
sqlite3_filename_wal
sqlite3_finalize
sqlite3_free
sqlite3_free_table
sqlite3_fts3_may_be_corrupt
sqlite3_fts5_init
sqlite3_fts_init
sqlite3_get_autocommit
sqlite3_get_auxdata
sqlite3_get_table
sqlite3_global_recover
sqlite3_hard_heap_limit64
sqlite3_initialize
sqlite3_interrupt
sqlite3_json_init
sqlite3_key
sqlite3_key_v2
sqlite3_keyword_check
sqlite3_keyword_count
sqlite3_keyword_name
sqlite3_last_insert_rowid
sqlite3_libversion
sqlite3_libversion_number
sqlite3_limit
sqlite3_load_extension
sqlite3_log
sqlite3_malloc
sqlite3_malloc64
sqlite3_memory_alarm
sqlite3_memory_highwater
sqlite3_memory_used
sqlite3_mprintf
sqlite3_msize
sqlite3_mutex_alloc
sqlite3_mutex_enter
sqlite3_mutex_free
sqlite3_mutex_leave
sqlite3_mutex_try
sqlite3_next_stmt
sqlite3_open
sqlite3_open16
sqlite3_open_v2
sqlite3_os_end
sqlite3_os_init
sqlite3_overload_function
sqlite3_percentile_init
sqlite3_prepare
sqlite3_prepare16
sqlite3_prepare16_v2
sqlite3_prepare16_v3
sqlite3_prepare_v2
sqlite3_prepare_v3
sqlite3_preupdate_count
sqlite3_preupdate_depth
sqlite3_preupdate_hook
sqlite3_preupdate_new
sqlite3_preupdate_old
sqlite3_profile
sqlite3_progress_handler
sqlite3_randomness
sqlite3_realloc
sqlite3_realloc64
sqlite3_regexp_init
sqlite3_rekey
sqlite3_rekey_v2
sqlite3_release_memory
sqlite3_reset
sqlite3_reset_auto_extension
sqlite3_result_blob
sqlite3_result_blob64
sqlite3_result_double
sqlite3_result_error
sqlite3_result_error16
sqlite3_result_error_code
sqlite3_result_error_nomem
sqlite3_result_error_toobig
sqlite3_result_int
sqlite3_result_int64
sqlite3_result_null
sqlite3_result_pointer
sqlite3_result_subtype
sqlite3_result_text
sqlite3_result_text16
sqlite3_result_text16be
sqlite3_result_text16le
sqlite3_result_text64
sqlite3_result_value
sqlite3_result_zeroblob
sqlite3_result_zeroblob64
sqlite3_rollback_hook
sqlite3_rtree_geometry_callback
sqlite3_rtree_query_callback
sqlite3_set_authorizer
sqlite3_set_auxdata
sqlite3_set_last_insert_rowid
sqlite3_sha_init
sqlite3_shutdown
sqlite3_sleep
sqlite3_snprintf
sqlite3_soft_heap_limit
sqlite3_soft_heap_limit64
sqlite3_sourceid
sqlite3_sql
sqlite3_status
sqlite3_status64
sqlite3_step
sqlite3_stmt_busy
sqlite3_stmt_isexplain
sqlite3_stmt_readonly
sqlite3_stmt_status
sqlite3_str_append
sqlite3_str_appendall
sqlite3_str_appendchar
sqlite3_str_appendf
sqlite3_str_errcode
sqlite3_str_finish
sqlite3_str_length
sqlite3_str_new
sqlite3_str_reset
sqlite3_str_value
sqlite3_str_vappendf
sqlite3_strglob
sqlite3_stricmp
sqlite3_strlike
sqlite3_strnicmp
sqlite3_system_errno
sqlite3_table_column_metadata
sqlite3_temp_directory
sqlite3_test_control
sqlite3_thread_cleanup
sqlite3_threadsafe
sqlite3_total_changes
sqlite3_totype_init
sqlite3_trace
sqlite3_trace_v2
sqlite3_transfer_bindings
sqlite3_update_hook
sqlite3_uri_boolean
sqlite3_uri_int64
sqlite3_uri_key
sqlite3_uri_parameter
sqlite3_user_data
sqlite3_value_blob
sqlite3_value_bytes
sqlite3_value_bytes16
sqlite3_value_double
sqlite3_value_dup
sqlite3_value_free
sqlite3_value_frombind
sqlite3_value_int
sqlite3_value_int64
sqlite3_value_nochange
sqlite3_value_numeric_type
sqlite3_value_pointer
sqlite3_value_subtype
sqlite3_value_text
sqlite3_value_text16
sqlite3_value_text16be
sqlite3_value_text16le
sqlite3_value_type
sqlite3_version
sqlite3_vfs_find
sqlite3_vfs_register
sqlite3_vfs_unregister
sqlite3_vmprintf
sqlite3_vsnprintf
sqlite3_vtab_collation
sqlite3_vtab_config
sqlite3_vtab_nochange
sqlite3_vtab_on_conflict
sqlite3_vtshim_init
sqlite3_wal_autocheckpoint
sqlite3_wal_checkpoint
sqlite3_wal_checkpoint_v2
sqlite3_wal_hook
sqlite3_win32_compact_heap
sqlite3_win32_is_nt
sqlite3_win32_mbcs_to_utf8
sqlite3_win32_mbcs_to_utf8_v2
sqlite3_win32_reset_heap
sqlite3_win32_set_directory
sqlite3_win32_set_directory16
sqlite3_win32_set_directory8
sqlite3_win32_sleep
sqlite3_win32_unicode_to_utf8
sqlite3_win32_utf8_to_mbcs
sqlite3_win32_utf8_to_mbcs_v2
sqlite3_win32_utf8_to_unicode
sqlite3_win32_write_debug
sqlite3changegroup_add
sqlite3changegroup_add_strm
sqlite3changegroup_delete
sqlite3changegroup_new
sqlite3changegroup_output
sqlite3changegroup_output_strm
sqlite3changeset_apply
sqlite3changeset_apply_strm
sqlite3changeset_apply_v2
sqlite3changeset_apply_v2_strm
sqlite3changeset_concat
sqlite3changeset_concat_strm
sqlite3changeset_conflict
sqlite3changeset_finalize
sqlite3changeset_fk_conflicts
sqlite3changeset_invert
sqlite3changeset_invert_strm
sqlite3changeset_new
sqlite3changeset_next
sqlite3changeset_old
sqlite3changeset_op
sqlite3changeset_pk
sqlite3changeset_start
sqlite3changeset_start_strm
sqlite3changeset_start_v2
sqlite3changeset_start_v2_strm
sqlite3rebaser_configure
sqlite3rebaser_create
sqlite3rebaser_delete
sqlite3rebaser_rebase
sqlite3rebaser_rebase_strm
sqlite3session_attach
sqlite3session_changeset
sqlite3session_changeset_strm
sqlite3session_config
sqlite3session_create
sqlite3session_delete
sqlite3session_diff
sqlite3session_enable
sqlite3session_indirect
sqlite3session_isempty
sqlite3session_patchset
sqlite3session_patchset_strm
sqlite3session_table_filter
Name
.text
Size
1.0MB
Virtual Size
1.0MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
141KB
Virtual Size
140KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
18KB
Virtual Size
22KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
2KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
31KB
Virtual Size
31KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=25, id=171, productName=VS2010 SP1 build 40219, version=40219,
count=59, id=158, productName=VS2010 SP1 build 40219, version=40219,
count=108, id=170, productName=VS2010 SP1 build 40219, version=40219,
count=5, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=129, id=1, productName=Unmarked objects,
count=1, id=174, version=40219,
count=1, id=155, productName=VS2010 SP1 build 40219, version=40219,
count=1, id=154, productName=VS2010 SP1 build 40219, version=40219,
count=1, id=157, productName=VS2010 SP1 build 40219, version=40219,
AsyncRAT/Plugins/SendFile.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 e5a0cf4361a74006d10ba2d098504b4caba6fa33b60e262f96b0df69611f3fd6
- MD5 7ad038cad76a3bef9140d8c5ffeb39de
- SHA1 ba17d57fef73e675d46127036d3c8c63449efd0b
- SHA512 e2cdc4007997fe004628c0d96cb37ecc076c82fe3db4e9dc8e7acc2676db1c1490a60600ab8429ec52c2b280b7c021b06148767c2f674bf4700357e69c2ccec6
- SSDEEP 1536:maQTgpCOyWALTXci//fs/qMtB3VDtpoDqGbuDpTaZb/crkF48m+Mq1NC01U:xM3sEo3VDtpouEeyb/crkFm+Mq1Nr2
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
114942
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
mscoree
_CorDllMain
Name
.text
Size
104KB
Virtual Size
104KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
820B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
AsyncRAT/Plugins/SendMemory.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 ddaae9a2176cf3bcf1b348acb632f6ec263b14ea082672a3bbe037b7228ab9bb
- MD5 03e50b906fc08d37335de63d80003d23
- SHA1 36c7792e7f2c30a0cf27ecabce97561097109d59
- SHA512 57f475fb6646babbabcb06bc339f1e1cad736ca6d8b5cd31c5f354fa63d1c8711892e4e2070b25f9495ffb1a2e43b1bd47c997be2f15e4f09caf815a42337922
- SSDEEP 3072:Zm1uw2sXhl6vw6sjDwdbY11z20Y0RASJEziY7i3OJDRlrnifxOAIdbz74qy+mYHN:QHwWLz20Y0RASJEziY7i3OJDRlrnifxa
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
116766
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
mscoree
_CorDllMain
Name
.text
Size
106KB
Virtual Size
106KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
828B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
AsyncRAT/Plugins/System.Data.SQLite.dll.config
- SHA256 cde00e0a0f52ed121d52c17338da42ffd9656d4f81a76df2dceda05c88f783ef
- MD5 8ab01db32f56322275cbd0864feb5d55
- SHA1 cbdb70f5fc04485af0d09ef7484faa7f8b3047bb
- SHA512 e52a5e341309bae40a4f69d67226a92dfc42b08d4e815da3a7df7295d68da6dcad8973d32af84f269692bd98634c4657e1394366574f5ec299eb50fa3d1db468
- MD5 SHA1 SHA512
AsyncRAT/Plugins/System.Data.SQLite.xml
- SHA256 0fb1342b154f09242fbb50ae8d637f8aecee6531582371bbc6032ecadc9c523f
- MD5 053a448987a06c4a32a9073a53f3e1e6
- SHA1 4097726eae3118545ea306fcf9effaec2138d442
- SHA512 d6f3e397a349db805a2cf498a4f6fcddfe73b74cef4067e858acd03c9d27aae817a6ac366864e1597f9c0b3895c27947c3285b7fc9a829bd519ee760dc60dc91
- SSDEEP 6144:XnXIbZ3Cc2KpJTf450TCrnKJKFu6JXU1IQt7TCqmA+yJ:XI
- MD5 SHA1 SHA512 SSDEEP
AsyncRAT/Plugins/System.IO.Compression.FileSystem.xml
- SHA256 cbc4399cf2253848752b991ccf52673b631acd415d7a9ff2fb87e980d083bd82
- MD5 852237e843c23c8f739f05adb6601c44
- SHA1 077ffbd0a54e9f3d52a26b6a68718f6ed21ce506
- SHA512 10f3555be7a55942b517ccd316cbf2a137a333d6a65d422185337472114d052bf838cb2e9fd813f673c2cfdfd4d174fa48c101e01a5a5a7caba5de0cd136c480
- SSDEEP 384:Y02WxfBNKwWxfUyKkWxfgSmadOKmaxhwQwQwbNVkmNdVozPDbb:YDmOMD
- MD5 SHA1 SHA512 SSDEEP
AsyncRAT/Plugins/UACOFF.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 f91e6a421ec35bb6074f66897a1cf0ae6c68445e0092889fe780ce495193d941
- MD5 49fe16bb96b13af41d06cb2afe981b2c
- SHA1 d73df864081b885e0b3a0aff16f994e2b3f97569
- SHA512 60796848c447fac1b70e2efe6ada52aec805c99883bf52ffc145e63986da72569b22ea9531bf0e11c72ebb24867052e55c8d69e3dd13d83f916426fe5610b24d
- SSDEEP 1536:w0BB7yoCad9hWK9+IPmgmoHoooooooooooooooooooooooooooooooooooooooo+:wc7/93etohvsok
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
82302
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
mscoree
_CorDllMain
Name
.text
Size
72KB
Virtual Size
72KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
868B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
AsyncRAT/Plugins/WDExclusion.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 3ad4f444c9696c3db01467e811cae952a81ab63f38e4581030355a51b7f5ac40
- MD5 cc6072d7ba3404e95697ad1d47b561ce
- SHA1 c099ba8f04e88f68294df0d21329b18c7a74bf35
- SHA512 27909c7c285972b39a52c337303079bfb77c897a5fc463256d44c695903abc73ce6451d99d4e89dc14ffef63a30380ef200a4015b68c0e9f99d552d70b747f9f
- SSDEEP 1536:V/Wu/CIVerogBjAqkv9hfh6dgm7fGoqHyGmzLrvoooooooooooooooooooooooo/:QIVe+Dv9hfYfvJsy
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
86798
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
mscoree
_CorDllMain
Name
.text
Size
77KB
Virtual Size
76KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
900B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
AsyncRAT/Plugins/Wallets.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 73ab737cfa5d2d918bb5b28f159a979e43e3a74276c345ff42c7bb725335a4be
- MD5 2d911c275555516ef7b00cbc043f118d
- SHA1 68fb04861ca00b6b81e0362491e48a9b980c6a21
- SHA512 2b64e7d50394915a6a501af4d860cb3a9c940b26ce73667cae0b3e6d36d78dda4b473aa5d9c0caafde7dd8e22d8c11e0220564a3b1caccb3ff25f7f50c6b826b
- SSDEEP 12288:FRnIWnu3Z7FXrPy4ix+LBltsgK7zXIqbkTQS4Ys50ie6Cfdg3zfJ:F5IWu3Z7V+4s+PtY/XIqYB4YNVvC
- MD5 SHA1 SHA512 SSDEEP
-
Detected Nirsoft tools
Free utilities often used by attackers which can steal passwords, product keys, etc.
-
NirSoft WebBrowserPassView
Password recovery tool for various web browsers
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
895550
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_DLL
PDB paths
mscoree
_CorDllMain
Name
.text
Size
867KB
Virtual Size
866KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
868B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
AsyncRAT/Plugins/WebBrowserPass.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 3c8c3e06c1036fcba1ca454f2ec7c52bb13a0bb7ab0d4a596d1f5d9258fad003
- MD5 db4a76ca1b9e30076e9e41bddf1c1908
- SHA1 1ca62a79fd65b4737a03f6d0f1c6f0d49c73dda3
- SHA512 7399ad1d8685c2aa9c1462f7ce4b945ec7f3428ce232e936d0b9cd70c28387721edc0edf269e0d07425172ab36a72497b55e1b96b5721aad83c77268daeea34b
- SSDEEP 6144:ImCb9uEIE+Z7EAXrvPRIxK0zBL/TIDC2dL3RltnfoBglM7zMUdsvk3zhAt76zkiE:nCwbZ7FXrPy4ix+LBltsgK7zXIqbkT
- MD5 SHA1 SHA512 SSDEEP
-
Detected Nirsoft tools
Free utilities often used by attackers which can steal passwords, product keys, etc.
-
NirSoft WebBrowserPassView
Password recovery tool for various web browsers
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
473694
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
mscoree
_CorDllMain
Name
.text
Size
455KB
Virtual Size
454KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
932B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
AsyncRAT/Plugins/desktop.ini
- SHA256 aafdec479168d39fe93e1a8b81258e522a8d58006cb8bf6b2f74ed15a4045fc5
- MD5 52672d35703aa82fd2d07ebbecff3d5c
- SHA1 1c49da5ab6d0a6e8206487fbbb3a431ac23db43f
- SHA512 9100dd29b1cf3b4b87ce00ebc8cca99a773b8bbba0404fc09fec3fc47f4940b6ac8674c803fe3cdad91871fb38e8230109047b0a3c3708e8a9c9cbccea05fd1e
- MD5 SHA1 SHA512
AsyncRAT/Plugins/gcapi.dll
- IMPHASH 18a9672c82a5e7523b8185670465b54e
- SHA256 73170761d6776c0debacfbbc61b6988cb8270a20174bf5c049768a264bb8ffaf
- MD5 1ce7d5a1566c8c449d0f6772a8c27900
- SHA1 60854185f6338e1bfc7497fd41aa44c5c00d8f85
- SHA512 7e3411be8614170ae91db1626c452997dc6db663d79130872a124af982ee1d457cefba00abd7f5269adce3052403be31238aecc3934c7379d224cb792d519753
- SSDEEP 6144:Tv/ioKdMF+LZD/ZRj1vwWrrUFMNoz4pFGxjEB1NYAOrabN2GZvFcD7:Td+LZrNwWrrwMNoz4vG1OYZabtK7
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
1
Major OS version
5
Entry point
134202
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
C:\b\build\slave\win\build\src\out\Release\gcapi_dll.dll.pdb
version
VerQueryValueW
GetFileVersionInfoW
GetFileVersionInfoSizeW
winmm
timeGetTime
kernel32
GetCommandLineW
LocalFree
IsDebuggerPresent
GetCurrentProcess
WaitForSingleObject
GetCurrentThreadId
Sleep
RaiseException
CreateDirectoryW
ReadFile
GetTempPathW
GetFileAttributesW
GetCurrentDirectoryW
ReleaseSRWLockExclusive
AcquireSRWLockExclusive
GetModuleHandleExW
GetProcAddress
GetModuleHandleW
GetVersionExW
GetNativeSystemInfo
TzSpecificLocalTimeToSystemTime
FileTimeToSystemTime
QueryPerformanceFrequency
SystemTimeToFileTime
SystemTimeToTzSpecificLocalTime
GetSystemTimeAsFileTime
QueryPerformanceCounter
SetEndOfFile
SetFilePointerEx
FlushFileBuffers
GetTickCount
FindClose
TlsSetValue
TlsAlloc
TlsGetValue
TlsFree
RtlCaptureStackBackTrace
SetUnhandledExceptionFilter
ExpandEnvironmentStringsW
VirtualQuery
GetSystemInfo
HeapAlloc
HeapReAlloc
HeapFree
OpenProcess
FindResourceW
SetHandleInformation
HeapSize
ReadConsoleW
UnlockFileEx
LockFileEx
GetWindowsDirectoryW
GetSystemDirectoryW
GetUserDefaultUILanguage
GetEnvironmentVariableW
CreateProcessW
ResumeThread
AssignProcessToJobObject
FormatMessageA
GetCurrentProcessId
CloseHandle
DeleteFileW
GetLastError
CreateFileW
GetModuleFileNameW
OutputDebugStringA
WriteFile
SetLastError
GetLocalTime
lstrlenW
LoadResource
LockResource
VirtualProtect
FreeLibrary
LoadLibraryExA
WideCharToMultiByte
EnterCriticalSection
LeaveCriticalSection
DeleteCriticalSection
EncodePointer
DecodePointer
MultiByteToWideChar
InitializeCriticalSectionAndSpinCount
CompareStringW
LCMapStringW
GetLocaleInfoW
GetStringTypeW
GetCPInfo
UnhandledExceptionFilter
TerminateProcess
IsProcessorFeaturePresent
InitializeSListHead
GetStartupInfoW
RtlUnwind
InterlockedFlushSList
LoadLibraryExW
GetConsoleCP
GetConsoleMode
ExitProcess
GetFullPathNameW
SetStdHandle
GetFileType
GetProcessHeap
GetModuleFileNameA
IsValidLocale
GetUserDefaultLCID
EnumSystemLocalesW
GetStdHandle
GetTimeZoneInformation
GetACP
WriteConsoleW
GetDriveTypeW
FindFirstFileExA
FindNextFileA
IsValidCodePage
GetOEMCP
GetCommandLineA
GetEnvironmentStringsW
FreeEnvironmentStringsW
SetEnvironmentVariableA
SetEnvironmentVariableW
OutputDebugStringW
SizeofResource
ole32
CoInitializeSecurity
CoCreateInstance
CoSetProxyBlanket
CoUninitialize
CoInitializeEx
CoTaskMemFree
user32
CharUpperW
SetWindowPos
GetShellWindow
EnumWindows
GetClassNameW
GetWindowThreadProcessId
advapi32
CreateProcessAsUserW
ConvertSidToStringSidW
RevertToSelf
ImpersonateLoggedOnUser
GetTokenInformation
FreeSid
SystemFunction036
DuplicateTokenEx
CheckTokenMembership
AllocateAndInitializeSid
OpenProcessToken
RegCloseKey
RegDeleteKeyW
RegCreateKeyExW
RegSetValueExW
RegOpenKeyExW
RegDeleteValueW
RegQueryValueExW
userenv
CreateEnvironmentBlock
DestroyEnvironmentBlock
oleaut32
SysAllocString
SysFreeString
VariantClear
rpcrt4
UuidCreate
CanOfferReactivation
CanOfferRelaunch
GetHandleVerifier
GoogleChromeCompatibilityCheck
GoogleChromeDaysSinceLastRun
LaunchGoogleChrome
LaunchGoogleChromeInBackground
LaunchGoogleChromeWithDimensions
ReactivateChrome
SetRelaunchOffered
Name
.text
Size
288KB
Virtual Size
288KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
75KB
Virtual Size
75KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
4KB
Virtual Size
13KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.gfids
Size
1024B
Virtual Size
808B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.tls
Size
512B
Virtual Size
2B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
13KB
Virtual Size
12KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=2, id=261, version=23013,
count=21, id=241, version=40116,
count=161, id=243, version=40116,
count=32, id=242, version=40116,
count=2, id=199, version=41118,
count=23, id=259, version=23907,
count=33, id=260, version=23907,
count=55, id=261, version=23907,
count=2, id=244, version=40116,
count=158, id=265, version=23918,
count=27, id=239, version=40116,
count=316, id=1, productName=Unmarked objects,
count=39, id=261, productName=VS2015 UPD2 build 23918, version=23918,
count=1, id=256, productName=VS2015 UPD2 build 23918, version=23918,
count=1, id=255, productName=VS2015 UPD2 build 23918, version=23918,
count=1, id=151,
count=1, id=258, productName=VS2015 UPD2 build 23918, version=23918,
AsyncRAT/Plugins/symbols.map
- SHA256 3e4a0859e8f4df2277d85c3ccf3af1e81ce3d188a6d6bf58b150678abff93632
- MD5 ce980185e04145ba1eafbbac6a5a8325
- SHA1 530807a561591e3ce404486888364aca0d37e93b
- SHA512 d21eb6fe03f0b30c6bf5c2fa011ddd518917bcbca7280b12244f2bd3e361c3c3abdde96638a984fbbf4a62e9fb60cc08f858ec2486110a0714b0786076797c57
- SSDEEP 768:xX+Qz6sPJwKTu2gRMV4QldLxzbL4me/VJ1ey+1jzKzCXqJentUkogZVygl7qfgTf:gQGsPJw+ulQpHhnxU1yaGK6Lyd2J5YY
- MD5 SHA1 SHA512 SSDEEP
AsyncRAT/Plugins/x64/SQLite.Interop.dll
- IMPHASH 6f6d0bdadb839e140d7a41e8d1e05c22
- SHA256 96c952efa25720eec63437df20e20b8959dde5230c6f1d5c30be68cf72665532
- MD5 df5c214d9a436a6a96c93cb8927194e4
- SHA1 70110af5cd1600ca5552c3ba69a0ac58e33750e4
- SHA512 2207725c056f109dffa95f2ac2bd2ffb8131232ce558173c1ef608d715922e5166f2974ce3a2e132cf405317d1502a14a71fbe895334707fd96b9350825d3b86
- SSDEEP 24576:NGOu/gMGBbocBpflBQO8wgLGYS/YxwFtXBCtt2Ry0X76AQKKf:cGBBrQO8R6YS/YxeBCO
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
2
Major OS version
5
Entry point
10596
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
C:\dev\sqlite\dotnet\bin\2010\x64\ReleaseNativeOnlyStatic\SQLite.Interop.pdb
kernel32
UnmapViewOfFile
SetEndOfFile
FreeLibrary
HeapAlloc
SystemTimeToFileTime
QueryPerformanceCounter
HeapFree
WaitForSingleObject
UnlockFile
FlushViewOfFile
LockFile
WaitForSingleObjectEx
OutputDebugStringW
GetTickCount
UnlockFileEx
GetProcessHeap
GetSystemTimeAsFileTime
FormatMessageA
WriteFile
InitializeCriticalSection
WideCharToMultiByte
LoadLibraryW
Sleep
FormatMessageW
GetVersionExW
HeapDestroy
LeaveCriticalSection
GetFileAttributesA
HeapCreate
HeapValidate
MapViewOfFile
ReadFile
CreateFileW
MultiByteToWideChar
FlushFileBuffers
GetTempPathW
GetLastError
GetProcAddress
HeapSize
LockFileEx
EnterCriticalSection
GetDiskFreeSpaceW
LoadLibraryA
CreateFileMappingA
CreateFileMappingW
GetDiskFreeSpaceA
GetSystemInfo
GetFileAttributesExW
DeleteCriticalSection
GetCurrentThreadId
OutputDebugStringA
GetVersionExA
CloseHandle
DeleteFileW
GetCurrentProcessId
GetTempPathA
LocalFree
GetSystemTime
AreFileApisANSI
DeleteFileA
TryEnterCriticalSection
SetFilePointer
HeapCompact
CreateMutexW
GetFileSize
CreateFileA
HeapReAlloc
GetFullPathNameA
GetFileAttributesW
GetFullPathNameW
ExitThread
CreateThread
FlsSetValue
GetCommandLineA
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
RtlVirtualUnwind
RtlLookupFunctionEntry
RtlCaptureContext
HeapSetInformation
GetVersion
EncodePointer
DecodePointer
GetTimeZoneInformation
FlsGetValue
FlsFree
SetLastError
FlsAlloc
RtlUnwindEx
GetModuleHandleW
ExitProcess
GetCPInfo
GetACP
GetOEMCP
IsValidCodePage
LCMapStringW
SetHandleCount
GetStdHandle
InitializeCriticalSectionAndSpinCount
GetFileType
GetStartupInfoW
GetModuleFileNameA
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetModuleFileNameW
GetStringTypeW
CompareStringW
SetEnvironmentVariableA
RaiseException
advapi32
CryptDestroyHash
CryptDecrypt
CryptDestroyKey
CryptCreateHash
CryptEncrypt
CryptDuplicateKey
CryptDeriveKey
CryptAcquireContextW
CryptHashData
interop_compileoption_get
interop_compileoption_used
interop_libversion
interop_sourceid
sqlite3_activate_see
sqlite3_aggregate_context
sqlite3_aggregate_count
sqlite3_auto_extension
sqlite3_backup_finish
sqlite3_backup_finish_interop
sqlite3_backup_init
sqlite3_backup_pagecount
sqlite3_backup_remaining
sqlite3_backup_step
sqlite3_bind_blob
sqlite3_bind_blob64
sqlite3_bind_double
sqlite3_bind_double_interop
sqlite3_bind_int
sqlite3_bind_int64
sqlite3_bind_int64_interop
sqlite3_bind_null
sqlite3_bind_parameter_count
sqlite3_bind_parameter_index
sqlite3_bind_parameter_name
sqlite3_bind_parameter_name_interop
sqlite3_bind_pointer
sqlite3_bind_text
sqlite3_bind_text16
sqlite3_bind_text64
sqlite3_bind_value
sqlite3_bind_zeroblob
sqlite3_bind_zeroblob64
sqlite3_blob_bytes
sqlite3_blob_close
sqlite3_blob_close_interop
sqlite3_blob_open
sqlite3_blob_read
sqlite3_blob_reopen
sqlite3_blob_write
sqlite3_busy_handler
sqlite3_busy_timeout
sqlite3_cancel_auto_extension
sqlite3_changes
sqlite3_changes_interop
sqlite3_clear_bindings
sqlite3_close
sqlite3_close_interop
sqlite3_close_v2
sqlite3_collation_needed
sqlite3_collation_needed16
sqlite3_column_blob
sqlite3_column_bytes
sqlite3_column_bytes16
sqlite3_column_count
sqlite3_column_database_name
sqlite3_column_database_name16
sqlite3_column_database_name16_interop
sqlite3_column_database_name_interop
sqlite3_column_decltype
sqlite3_column_decltype16
sqlite3_column_decltype16_interop
sqlite3_column_decltype_interop
sqlite3_column_double
sqlite3_column_double_interop
sqlite3_column_int
sqlite3_column_int64
sqlite3_column_int64_interop
sqlite3_column_name
sqlite3_column_name16
sqlite3_column_name16_interop
sqlite3_column_name_interop
sqlite3_column_origin_name
sqlite3_column_origin_name16
sqlite3_column_origin_name16_interop
sqlite3_column_origin_name_interop
sqlite3_column_table_name
sqlite3_column_table_name16
sqlite3_column_table_name16_interop
sqlite3_column_table_name_interop
sqlite3_column_text
sqlite3_column_text16
sqlite3_column_text16_interop
sqlite3_column_text_interop
sqlite3_column_type
sqlite3_column_value
sqlite3_commit_hook
sqlite3_compileoption_get
sqlite3_compileoption_used
sqlite3_complete
sqlite3_complete16
sqlite3_config
sqlite3_context_collcompare_interop
sqlite3_context_collseq_interop
sqlite3_context_db_handle
sqlite3_create_collation
sqlite3_create_collation16
sqlite3_create_collation_v2
sqlite3_create_disposable_module
sqlite3_create_disposable_module_interop
sqlite3_create_function
sqlite3_create_function16
sqlite3_create_function_interop
sqlite3_create_function_v2
sqlite3_create_module
sqlite3_create_module_v2
sqlite3_create_window_function
sqlite3_cursor_rowid_interop
sqlite3_data_count
sqlite3_data_directory
sqlite3_db_cacheflush
sqlite3_db_config
sqlite3_db_filename
sqlite3_db_handle
sqlite3_db_mutex
sqlite3_db_readonly
sqlite3_db_release_memory
sqlite3_db_status
sqlite3_declare_vtab
sqlite3_dispose_module
sqlite3_drop_modules
sqlite3_enable_load_extension
sqlite3_enable_shared_cache
sqlite3_errcode
sqlite3_errmsg
sqlite3_errmsg16
sqlite3_errmsg_interop
sqlite3_errstr
sqlite3_exec
sqlite3_expanded_sql
sqlite3_expired
sqlite3_extended_errcode
sqlite3_extended_result_codes
sqlite3_file_control
sqlite3_filename_database
sqlite3_filename_journal
sqlite3_filename_wal
sqlite3_finalize
sqlite3_finalize_interop
sqlite3_free
sqlite3_free_table
sqlite3_fts3_may_be_corrupt
sqlite3_fts5_init
sqlite3_fts_init
sqlite3_get_autocommit
sqlite3_get_auxdata
sqlite3_get_table
sqlite3_global_recover
sqlite3_hard_heap_limit64
sqlite3_index_column_info_interop
sqlite3_initialize
sqlite3_interrupt
sqlite3_json_init
sqlite3_key
sqlite3_key_v2
sqlite3_keyword_check
sqlite3_keyword_count
sqlite3_keyword_name
sqlite3_last_insert_rowid
sqlite3_last_insert_rowid_interop
sqlite3_libversion
sqlite3_libversion_number
sqlite3_limit
sqlite3_load_extension
sqlite3_log
sqlite3_malloc
sqlite3_malloc64
sqlite3_malloc_size_interop
sqlite3_memory_alarm
sqlite3_memory_highwater
sqlite3_memory_highwater_interop
sqlite3_memory_used
sqlite3_memory_used_interop
sqlite3_mprintf
sqlite3_msize
sqlite3_msize_interop
sqlite3_mutex_alloc
sqlite3_mutex_enter
sqlite3_mutex_free
sqlite3_mutex_leave
sqlite3_mutex_try
sqlite3_next_stmt
sqlite3_open
sqlite3_open16
sqlite3_open16_interop
sqlite3_open_interop
sqlite3_open_v2
sqlite3_os_end
sqlite3_os_init
sqlite3_overload_function
sqlite3_percentile_init
sqlite3_prepare
sqlite3_prepare16
sqlite3_prepare16_interop
sqlite3_prepare16_v2
sqlite3_prepare16_v3
sqlite3_prepare_interop
sqlite3_prepare_v2
sqlite3_prepare_v3
sqlite3_preupdate_count
sqlite3_preupdate_depth
sqlite3_preupdate_hook
sqlite3_preupdate_new
sqlite3_preupdate_old
sqlite3_profile
sqlite3_progress_handler
sqlite3_randomness
sqlite3_realloc
sqlite3_realloc64
sqlite3_regexp_init
sqlite3_rekey
sqlite3_rekey_v2
sqlite3_release_memory
sqlite3_reset
sqlite3_reset_auto_extension
sqlite3_reset_interop
sqlite3_result_blob
sqlite3_result_blob64
sqlite3_result_double
sqlite3_result_double_interop
sqlite3_result_error
sqlite3_result_error16
sqlite3_result_error_code
sqlite3_result_error_nomem
sqlite3_result_error_toobig
sqlite3_result_int
sqlite3_result_int64
sqlite3_result_int64_interop
sqlite3_result_null
sqlite3_result_pointer
sqlite3_result_subtype
sqlite3_result_text
sqlite3_result_text16
sqlite3_result_text16be
sqlite3_result_text16le
sqlite3_result_text64
sqlite3_result_value
sqlite3_result_zeroblob
sqlite3_result_zeroblob64
sqlite3_rollback_hook
sqlite3_rtree_geometry_callback
sqlite3_rtree_query_callback
sqlite3_set_authorizer
sqlite3_set_auxdata
sqlite3_set_last_insert_rowid
sqlite3_sha_init
sqlite3_shutdown
sqlite3_sleep
sqlite3_snprintf
sqlite3_soft_heap_limit
sqlite3_soft_heap_limit64
sqlite3_sourceid
sqlite3_sql
sqlite3_status
sqlite3_status64
sqlite3_step
sqlite3_stmt_busy
sqlite3_stmt_isexplain
sqlite3_stmt_readonly
sqlite3_stmt_status
sqlite3_str_append
sqlite3_str_appendall
sqlite3_str_appendchar
sqlite3_str_appendf
sqlite3_str_errcode
sqlite3_str_finish
sqlite3_str_length
sqlite3_str_new
sqlite3_str_reset
sqlite3_str_value
sqlite3_str_vappendf
sqlite3_strglob
sqlite3_stricmp
sqlite3_strlike
sqlite3_strnicmp
sqlite3_system_errno
sqlite3_table_column_metadata
sqlite3_table_column_metadata_interop
sqlite3_table_cursor_interop
sqlite3_temp_directory
sqlite3_test_control
sqlite3_thread_cleanup
sqlite3_threadsafe
sqlite3_total_changes
sqlite3_totype_init
sqlite3_trace
sqlite3_trace_v2
sqlite3_transfer_bindings
sqlite3_update_hook
sqlite3_uri_boolean
sqlite3_uri_int64
sqlite3_uri_key
sqlite3_uri_parameter
sqlite3_user_data
sqlite3_value_blob
sqlite3_value_bytes
sqlite3_value_bytes16
sqlite3_value_double
sqlite3_value_double_interop
sqlite3_value_dup
sqlite3_value_free
sqlite3_value_frombind
sqlite3_value_int
sqlite3_value_int64
sqlite3_value_int64_interop
sqlite3_value_nochange
sqlite3_value_numeric_type
sqlite3_value_pointer
sqlite3_value_subtype
sqlite3_value_text
sqlite3_value_text16
sqlite3_value_text16_interop
sqlite3_value_text16be
sqlite3_value_text16le
sqlite3_value_text_interop
sqlite3_value_type
sqlite3_version
sqlite3_vfs_find
sqlite3_vfs_register
sqlite3_vfs_unregister
sqlite3_vmprintf
sqlite3_vsnprintf
sqlite3_vtab_collation
sqlite3_vtab_config
sqlite3_vtab_nochange
sqlite3_vtab_on_conflict
sqlite3_vtshim_init
sqlite3_wal_autocheckpoint
sqlite3_wal_checkpoint
sqlite3_wal_checkpoint_v2
sqlite3_wal_hook
sqlite3_win32_compact_heap
sqlite3_win32_is_nt
sqlite3_win32_mbcs_to_utf8
sqlite3_win32_mbcs_to_utf8_v2
sqlite3_win32_reset_heap
sqlite3_win32_set_directory
sqlite3_win32_set_directory16
sqlite3_win32_set_directory8
sqlite3_win32_sleep
sqlite3_win32_unicode_to_utf8
sqlite3_win32_utf8_to_mbcs
sqlite3_win32_utf8_to_mbcs_v2
sqlite3_win32_utf8_to_unicode
sqlite3_win32_write_debug
sqlite3changegroup_add
sqlite3changegroup_add_strm
sqlite3changegroup_delete
sqlite3changegroup_new
sqlite3changegroup_output
sqlite3changegroup_output_strm
sqlite3changeset_apply
sqlite3changeset_apply_strm
sqlite3changeset_apply_v2
sqlite3changeset_apply_v2_strm
sqlite3changeset_concat
sqlite3changeset_concat_strm
sqlite3changeset_conflict
sqlite3changeset_finalize
sqlite3changeset_fk_conflicts
sqlite3changeset_invert
sqlite3changeset_invert_strm
sqlite3changeset_new
sqlite3changeset_next
sqlite3changeset_old
sqlite3changeset_op
sqlite3changeset_pk
sqlite3changeset_start
sqlite3changeset_start_strm
sqlite3changeset_start_v2
sqlite3changeset_start_v2_strm
sqlite3rebaser_configure
sqlite3rebaser_create
sqlite3rebaser_delete
sqlite3rebaser_rebase
sqlite3rebaser_rebase_strm
sqlite3session_attach
sqlite3session_changeset
sqlite3session_changeset_strm
sqlite3session_config
sqlite3session_create
sqlite3session_delete
sqlite3session_diff
sqlite3session_enable
sqlite3session_indirect
sqlite3session_isempty
sqlite3session_patchset
sqlite3session_patchset_strm
sqlite3session_table_filter
Name
.text
Size
1.2MB
Virtual Size
1.2MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
210KB
Virtual Size
210KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
25KB
Virtual Size
31KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
69KB
Virtual Size
68KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
text
Size
7KB
Virtual Size
7KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
Name
data
Size
25KB
Virtual Size
24KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
2KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
8KB
Virtual Size
7KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=25, id=171, productName=VS2010 SP1 build 40219, version=40219,
count=110, id=170, productName=VS2010 SP1 build 40219, version=40219,
count=17, id=158, productName=VS2010 SP1 build 40219, version=40219,
count=5, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=129, id=1, productName=Unmarked objects,
count=1, id=174, version=40219,
count=1, id=155, productName=VS2010 SP1 build 40219, version=40219,
count=1, id=154, productName=VS2010 SP1 build 40219, version=40219,
count=1, id=157, productName=VS2010 SP1 build 40219, version=40219,
AsyncRAT/Plugins/x86/SQLite.Interop.dll
- IMPHASH 43cf4064308c8cffa2acc646c51eabf0
- SHA256 ba0bf347cd8966e53efa282df84a9f966bbc2ff99642ee0be5b2a86644bb7f5e
- MD5 c09a5ff0cf2613ebcf29357be05c9bc3
- SHA1 0ed14fa706e2e46933c4dbc27c8329cd99201070
- SHA512 99eda404ec421756049f5d7fc42c27079187c6afb35ab125f4b8a8f9764687bf1777bac018ad0b7fd7640b1215f0b3a2741689ead569bec938aef428510ccaf8
- SSDEEP 24576:wFnIJ6GG4PYmGL/mnOkumid0vuP0CKJUvo6FywlapXf7bGKHu9b0D:wxIJGjmGL/SOSWP1AUsHGn0D
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
1
Major OS version
5
Entry point
10144
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
c:\dev\sqlite\dotnet\bin\2010\Win32\ReleaseNativeOnlyStatic\SQLite.Interop.pdb
kernel32
UnmapViewOfFile
SetEndOfFile
FreeLibrary
HeapAlloc
SystemTimeToFileTime
QueryPerformanceCounter
HeapFree
WaitForSingleObject
InterlockedCompareExchange
UnlockFile
FlushViewOfFile
LockFile
WaitForSingleObjectEx
OutputDebugStringW
GetTickCount
UnlockFileEx
GetProcessHeap
GetSystemTimeAsFileTime
FormatMessageA
WriteFile
InitializeCriticalSection
WideCharToMultiByte
LoadLibraryW
Sleep
FormatMessageW
GetVersionExW
HeapDestroy
LeaveCriticalSection
GetFileAttributesA
HeapCreate
MapViewOfFile
GetFileAttributesW
ReadFile
CreateFileW
MultiByteToWideChar
FlushFileBuffers
GetTempPathW
GetLastError
GetProcAddress
HeapSize
LockFileEx
EnterCriticalSection
GetDiskFreeSpaceW
LoadLibraryA
CreateFileMappingA
CreateFileMappingW
GetDiskFreeSpaceA
GetSystemInfo
GetFileAttributesExW
DeleteCriticalSection
GetCurrentThreadId
OutputDebugStringA
GetVersionExA
CloseHandle
DeleteFileW
GetCurrentProcessId
GetTempPathA
LocalFree
GetSystemTime
AreFileApisANSI
DeleteFileA
TryEnterCriticalSection
SetFilePointer
HeapCompact
CreateMutexW
GetFileSize
CreateFileA
HeapReAlloc
GetFullPathNameA
HeapValidate
GetFullPathNameW
ExitThread
CreateThread
DecodePointer
GetCommandLineA
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
IsProcessorFeaturePresent
EncodePointer
GetTimeZoneInformation
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
InterlockedIncrement
GetModuleHandleW
SetLastError
InterlockedDecrement
ExitProcess
GetCPInfo
GetACP
GetOEMCP
IsValidCodePage
LCMapStringW
SetHandleCount
GetStdHandle
InitializeCriticalSectionAndSpinCount
GetFileType
GetStartupInfoW
GetModuleFileNameA
FreeEnvironmentStringsW
GetEnvironmentStringsW
RaiseException
GetModuleFileNameW
RtlUnwind
GetStringTypeW
CompareStringW
SetEnvironmentVariableA
advapi32
CryptDestroyHash
CryptDecrypt
CryptDestroyKey
CryptCreateHash
CryptEncrypt
CryptDuplicateKey
CryptDeriveKey
CryptAcquireContextW
CryptHashData
_interop_compileoption_get@4
_interop_compileoption_used@4
_interop_libversion@0
_interop_sourceid@0
_sqlite3_backup_finish_interop@4
_sqlite3_bind_double_interop@12
_sqlite3_bind_int64_interop@12
_sqlite3_bind_parameter_name_interop@12
_sqlite3_blob_close_interop@4
_sqlite3_changes_interop@4
_sqlite3_close_interop@4
_sqlite3_column_database_name16_interop@12
_sqlite3_column_database_name_interop@12
_sqlite3_column_decltype16_interop@12
_sqlite3_column_decltype_interop@12
_sqlite3_column_double_interop@12
_sqlite3_column_int64_interop@12
_sqlite3_column_name16_interop@12
_sqlite3_column_name_interop@12
_sqlite3_column_origin_name16_interop@12
_sqlite3_column_origin_name_interop@12
_sqlite3_column_table_name16_interop@12
_sqlite3_column_table_name_interop@12
_sqlite3_column_text16_interop@12
_sqlite3_column_text_interop@12
_sqlite3_context_collcompare_interop@20
_sqlite3_context_collseq_interop@16
_sqlite3_create_disposable_module_interop@112
_sqlite3_create_function_interop@36
_sqlite3_cursor_rowid_interop@12
_sqlite3_errmsg_interop@8
_sqlite3_finalize_interop@4
_sqlite3_index_column_info_interop@32
_sqlite3_last_insert_rowid_interop@8
_sqlite3_malloc_size_interop@4
_sqlite3_memory_highwater_interop@8
_sqlite3_memory_used_interop@4
_sqlite3_msize_interop@8
_sqlite3_open16_interop@20
_sqlite3_open_interop@20
_sqlite3_prepare16_interop@24
_sqlite3_prepare_interop@24
_sqlite3_reset_interop@4
_sqlite3_result_double_interop@8
_sqlite3_result_int64_interop@8
_sqlite3_table_column_metadata_interop@44
_sqlite3_table_cursor_interop@12
_sqlite3_value_double_interop@8
_sqlite3_value_int64_interop@8
_sqlite3_value_text16_interop@8
_sqlite3_value_text_interop@8
sqlite3_activate_see
sqlite3_aggregate_context
sqlite3_aggregate_count
sqlite3_auto_extension
sqlite3_backup_finish
sqlite3_backup_init
sqlite3_backup_pagecount
sqlite3_backup_remaining
sqlite3_backup_step
sqlite3_bind_blob
sqlite3_bind_blob64
sqlite3_bind_double
sqlite3_bind_int
sqlite3_bind_int64
sqlite3_bind_null
sqlite3_bind_parameter_count
sqlite3_bind_parameter_index
sqlite3_bind_parameter_name
sqlite3_bind_pointer
sqlite3_bind_text
sqlite3_bind_text16
sqlite3_bind_text64
sqlite3_bind_value
sqlite3_bind_zeroblob
sqlite3_bind_zeroblob64
sqlite3_blob_bytes
sqlite3_blob_close
sqlite3_blob_open
sqlite3_blob_read
sqlite3_blob_reopen
sqlite3_blob_write
sqlite3_busy_handler
sqlite3_busy_timeout
sqlite3_cancel_auto_extension
sqlite3_changes
sqlite3_clear_bindings
sqlite3_close
sqlite3_close_v2
sqlite3_collation_needed
sqlite3_collation_needed16
sqlite3_column_blob
sqlite3_column_bytes
sqlite3_column_bytes16
sqlite3_column_count
sqlite3_column_database_name
sqlite3_column_database_name16
sqlite3_column_decltype
sqlite3_column_decltype16
sqlite3_column_double
sqlite3_column_int
sqlite3_column_int64
sqlite3_column_name
sqlite3_column_name16
sqlite3_column_origin_name
sqlite3_column_origin_name16
sqlite3_column_table_name
sqlite3_column_table_name16
sqlite3_column_text
sqlite3_column_text16
sqlite3_column_type
sqlite3_column_value
sqlite3_commit_hook
sqlite3_compileoption_get
sqlite3_compileoption_used
sqlite3_complete
sqlite3_complete16
sqlite3_config
sqlite3_context_db_handle
sqlite3_create_collation
sqlite3_create_collation16
sqlite3_create_collation_v2
sqlite3_create_disposable_module
sqlite3_create_function
sqlite3_create_function16
sqlite3_create_function_v2
sqlite3_create_module
sqlite3_create_module_v2
sqlite3_create_window_function
sqlite3_data_count
sqlite3_data_directory
sqlite3_db_cacheflush
sqlite3_db_config
sqlite3_db_filename
sqlite3_db_handle
sqlite3_db_mutex
sqlite3_db_readonly
sqlite3_db_release_memory
sqlite3_db_status
sqlite3_declare_vtab
sqlite3_dispose_module
sqlite3_drop_modules
sqlite3_enable_load_extension
sqlite3_enable_shared_cache
sqlite3_errcode
sqlite3_errmsg
sqlite3_errmsg16
sqlite3_errstr
sqlite3_exec
sqlite3_expanded_sql
sqlite3_expired
sqlite3_extended_errcode
sqlite3_extended_result_codes
sqlite3_file_control
sqlite3_filename_database
sqlite3_filename_journal
sqlite3_filename_wal
sqlite3_finalize
sqlite3_free
sqlite3_free_table
sqlite3_fts3_may_be_corrupt
sqlite3_fts5_init
sqlite3_fts_init
sqlite3_get_autocommit
sqlite3_get_auxdata
sqlite3_get_table
sqlite3_global_recover
sqlite3_hard_heap_limit64
sqlite3_initialize
sqlite3_interrupt
sqlite3_json_init
sqlite3_key
sqlite3_key_v2
sqlite3_keyword_check
sqlite3_keyword_count
sqlite3_keyword_name
sqlite3_last_insert_rowid
sqlite3_libversion
sqlite3_libversion_number
sqlite3_limit
sqlite3_load_extension
sqlite3_log
sqlite3_malloc
sqlite3_malloc64
sqlite3_memory_alarm
sqlite3_memory_highwater
sqlite3_memory_used
sqlite3_mprintf
sqlite3_msize
sqlite3_mutex_alloc
sqlite3_mutex_enter
sqlite3_mutex_free
sqlite3_mutex_leave
sqlite3_mutex_try
sqlite3_next_stmt
sqlite3_open
sqlite3_open16
sqlite3_open_v2
sqlite3_os_end
sqlite3_os_init
sqlite3_overload_function
sqlite3_percentile_init
sqlite3_prepare
sqlite3_prepare16
sqlite3_prepare16_v2
sqlite3_prepare16_v3
sqlite3_prepare_v2
sqlite3_prepare_v3
sqlite3_preupdate_count
sqlite3_preupdate_depth
sqlite3_preupdate_hook
sqlite3_preupdate_new
sqlite3_preupdate_old
sqlite3_profile
sqlite3_progress_handler
sqlite3_randomness
sqlite3_realloc
sqlite3_realloc64
sqlite3_regexp_init
sqlite3_rekey
sqlite3_rekey_v2
sqlite3_release_memory
sqlite3_reset
sqlite3_reset_auto_extension
sqlite3_result_blob
sqlite3_result_blob64
sqlite3_result_double
sqlite3_result_error
sqlite3_result_error16
sqlite3_result_error_code
sqlite3_result_error_nomem
sqlite3_result_error_toobig
sqlite3_result_int
sqlite3_result_int64
sqlite3_result_null
sqlite3_result_pointer
sqlite3_result_subtype
sqlite3_result_text
sqlite3_result_text16
sqlite3_result_text16be
sqlite3_result_text16le
sqlite3_result_text64
sqlite3_result_value
sqlite3_result_zeroblob
sqlite3_result_zeroblob64
sqlite3_rollback_hook
sqlite3_rtree_geometry_callback
sqlite3_rtree_query_callback
sqlite3_set_authorizer
sqlite3_set_auxdata
sqlite3_set_last_insert_rowid
sqlite3_sha_init
sqlite3_shutdown
sqlite3_sleep
sqlite3_snprintf
sqlite3_soft_heap_limit
sqlite3_soft_heap_limit64
sqlite3_sourceid
sqlite3_sql
sqlite3_status
sqlite3_status64
sqlite3_step
sqlite3_stmt_busy
sqlite3_stmt_isexplain
sqlite3_stmt_readonly
sqlite3_stmt_status
sqlite3_str_append
sqlite3_str_appendall
sqlite3_str_appendchar
sqlite3_str_appendf
sqlite3_str_errcode
sqlite3_str_finish
sqlite3_str_length
sqlite3_str_new
sqlite3_str_reset
sqlite3_str_value
sqlite3_str_vappendf
sqlite3_strglob
sqlite3_stricmp
sqlite3_strlike
sqlite3_strnicmp
sqlite3_system_errno
sqlite3_table_column_metadata
sqlite3_temp_directory
sqlite3_test_control
sqlite3_thread_cleanup
sqlite3_threadsafe
sqlite3_total_changes
sqlite3_totype_init
sqlite3_trace
sqlite3_trace_v2
sqlite3_transfer_bindings
sqlite3_update_hook
sqlite3_uri_boolean
sqlite3_uri_int64
sqlite3_uri_key
sqlite3_uri_parameter
sqlite3_user_data
sqlite3_value_blob
sqlite3_value_bytes
sqlite3_value_bytes16
sqlite3_value_double
sqlite3_value_dup
sqlite3_value_free
sqlite3_value_frombind
sqlite3_value_int
sqlite3_value_int64
sqlite3_value_nochange
sqlite3_value_numeric_type
sqlite3_value_pointer
sqlite3_value_subtype
sqlite3_value_text
sqlite3_value_text16
sqlite3_value_text16be
sqlite3_value_text16le
sqlite3_value_type
sqlite3_version
sqlite3_vfs_find
sqlite3_vfs_register
sqlite3_vfs_unregister
sqlite3_vmprintf
sqlite3_vsnprintf
sqlite3_vtab_collation
sqlite3_vtab_config
sqlite3_vtab_nochange
sqlite3_vtab_on_conflict
sqlite3_vtshim_init
sqlite3_wal_autocheckpoint
sqlite3_wal_checkpoint
sqlite3_wal_checkpoint_v2
sqlite3_wal_hook
sqlite3_win32_compact_heap
sqlite3_win32_is_nt
sqlite3_win32_mbcs_to_utf8
sqlite3_win32_mbcs_to_utf8_v2
sqlite3_win32_reset_heap
sqlite3_win32_set_directory
sqlite3_win32_set_directory16
sqlite3_win32_set_directory8
sqlite3_win32_sleep
sqlite3_win32_unicode_to_utf8
sqlite3_win32_utf8_to_mbcs
sqlite3_win32_utf8_to_mbcs_v2
sqlite3_win32_utf8_to_unicode
sqlite3_win32_write_debug
sqlite3changegroup_add
sqlite3changegroup_add_strm
sqlite3changegroup_delete
sqlite3changegroup_new
sqlite3changegroup_output
sqlite3changegroup_output_strm
sqlite3changeset_apply
sqlite3changeset_apply_strm
sqlite3changeset_apply_v2
sqlite3changeset_apply_v2_strm
sqlite3changeset_concat
sqlite3changeset_concat_strm
sqlite3changeset_conflict
sqlite3changeset_finalize
sqlite3changeset_fk_conflicts
sqlite3changeset_invert
sqlite3changeset_invert_strm
sqlite3changeset_new
sqlite3changeset_next
sqlite3changeset_old
sqlite3changeset_op
sqlite3changeset_pk
sqlite3changeset_start
sqlite3changeset_start_strm
sqlite3changeset_start_v2
sqlite3changeset_start_v2_strm
sqlite3rebaser_configure
sqlite3rebaser_create
sqlite3rebaser_delete
sqlite3rebaser_rebase
sqlite3rebaser_rebase_strm
sqlite3session_attach
sqlite3session_changeset
sqlite3session_changeset_strm
sqlite3session_config
sqlite3session_create
sqlite3session_delete
sqlite3session_diff
sqlite3session_enable
sqlite3session_indirect
sqlite3session_isempty
sqlite3session_patchset
sqlite3session_patchset_strm
sqlite3session_table_filter
Name
.text
Size
1.0MB
Virtual Size
1.0MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
141KB
Virtual Size
140KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
18KB
Virtual Size
22KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
2KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
31KB
Virtual Size
31KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=25, id=171, productName=VS2010 SP1 build 40219, version=40219,
count=59, id=158, productName=VS2010 SP1 build 40219, version=40219,
count=108, id=170, productName=VS2010 SP1 build 40219, version=40219,
count=5, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=129, id=1, productName=Unmarked objects,
count=1, id=174, version=40219,
count=1, id=155, productName=VS2010 SP1 build 40219, version=40219,
count=1, id=154, productName=VS2010 SP1 build 40219, version=40219,
count=1, id=157, productName=VS2010 SP1 build 40219, version=40219,
AsyncRAT/ServerCertificate.p12
- SHA256 d73409a25395eacb33fb90a165b495a283704f469722bc3bf9fe7e0d3fdd6073
- MD5 9fd931398092ed4bd35f18ef1ad2a666
- SHA1 038992397bb478f9bcaf248256f8421f7f6450e6
- SHA512 41afab08899a458782b8b1afe93d773d85eae64903abe1fbd8bfaf00df4c0ca653a97343528d7dd0ae63a739c35fc7a06438e67337016b088797cbed3cd75528
- SSDEEP 96:NbqDPX/vn8oswBaJ2ROCqPSlbSicXtfw8G89E:NWr59BaJ2RvlS9Y8GYE
- MD5 SHA1 SHA512 SSDEEP
AsyncRAT/Stub/Stub.exe
- IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
- SHA256 d79bc4eb5781ed5a3d71b006e90b65b9450d8bbf9f503225d8d8bcac065afb42
- MD5 640779951565901779ad17c0c7587b84
- SHA1 1ece2620069ed98ac154e42e53400d2be272eb98
- SHA512 f976da337eb098c8079af8e741edffba3de8c2391fbad72a945841da5e744f6d95c3e00ff8efc34d29b988d27af2165d3e81ab1740875006092866b3adab81ab
- SSDEEP 768:w36mueAgkwnGjM2DMk0ExDW++EXVDR54gL8ra/dqItj22waHtav/LrwQpgQ:wKmuFgBntkc++EXVl54s8ry8ILIxgQ
- MD5 SHA1 SHA512 SSDEEP
-
Async RAT payload
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
62250
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB paths
mscoree
_CorExeMain
Name
.text
Size
53KB
Virtual Size
52KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
2KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
AsyncRAT/Stub/Stub.exe.config
- SHA256 d524761c17cf0dea94109f3fcdacd2ecb67550115ff9e0307f78c05055419efe
- MD5 fa7dab2218c3ab0be0feda07b975d8aa
- SHA1 2fe77bb2627c6a2df6b433cc10699c629412d40c
- SHA512 14a3ce4345cd45f4e5e28478886da4756f9b78423663f051388a5cf380c3f642f3bccb80d0051eab5fa2c50e3f2ab4cee52c6b208b38a914c92bfece15ba4fa0
- MD5 SHA1 SHA512
AsyncRAT/Vestris.ResourceLib.xml
- SHA256 d243a0b107c44e654a53bf7941a9ade0dab6476b36eaf0fbe990cf99036bd12e
- MD5 a0152babc033f3c62eadb7c4baa75cab
- SHA1 b6317dbee83e6f2c5f3eafd21c8ca0bc16f29227
- SHA512 f8c9f9c5c27ceff7894edd21c2bfa58a3066c2fb2ff35ee5c99df77e9dd553e427761c9882426b7e3de76697967652957c2a36ff321d1e33d4b5279f6a840fb8
- SSDEEP 3072:uuaOKJ1AAlTNKLNWs/+Y4Y4d8yUa/jvGF:ux1AAlTgLNqljvGF
- MD5 SHA1 SHA512 SSDEEP
AsyncRAT/dnlib.xml
- SHA256 2ca9d376c327d55ada644f43d5280a90817048fb8eb7e1dad576db5feb0bd59c
- MD5 7273a60aa5a1bcbaae384bf4f7349d8d
- SHA1 e9d04cbc5d40dd37c2d22d2f096992df025340be
- SHA512 efbd7539a571fe275e92ad0a0d7ccdb8cb731bd507a8ccd648c5d3a03f71886218ddcdee71012b7355c9c8477ef38e6582f7d5700ef30266cb11d0ae469f6e3f
- SSDEEP 6144:V+8+jpvmE83GrOekcXhR+y+cNUaOtCNdn:+pvmE83GrOGXhR+y+cNUaOtCNdn
- MD5 SHA1 SHA512 SSDEEP
AsyncRAT/proxlib.dll
- IMPHASH fef8ddc2ebd24bd94fe8bc7869611463
- SHA256 292d430ebe76a81f897a3d71ae24cd3cb9c6bd6eae86921fa2ac4b21f630ffee
- MD5 11ad156c494bc6ea638ae3ccf501d12a
- SHA1 146708c8fdc147aa43319f87186ce4e550359390
- SHA512 5237035af93b1ed3870a636b12b88bafa82d187187989197a34290727ff98b2dedcbfc709ec0a1bf3ee730c38428b9e23b54f7af86d200e8c132a3a756fd1a74
- SSDEEP 768:9BVZ85kRAYzxv4XEa12zB4DrhlVtXStvjLaPCc/E9yGEDin23jqrm7:9h8OuYB4XEqKB45lzXKj2PCc89PK7
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
1
Major OS version
5
Entry point
14496
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
ws2_32
inet_addr
gethostbyname
inet_ntoa
WSAStartup
ntohs
ioctlsocket
select
WSAGetLastError
recv
bind
socket
send
listen
accept
htons
closesocket
kernel32
InterlockedIncrement
FlushFileBuffers
CloseHandle
CreateFileW
WriteConsoleW
SetStdHandle
IsProcessorFeaturePresent
HeapSize
RtlUnwind
HeapReAlloc
GetConsoleMode
GetConsoleCP
SetFilePointer
LeaveCriticalSection
EnterCriticalSection
WaitForSingleObject
GetTickCount
InitializeCriticalSectionAndSpinCount
Sleep
DeleteCriticalSection
CreateThread
GetLastError
HeapFree
HeapAlloc
GetCurrentThreadId
DecodePointer
GetCommandLineA
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
HeapCreate
HeapDestroy
GetProcAddress
GetModuleHandleW
ExitProcess
WriteFile
GetStdHandle
GetModuleFileNameW
EncodePointer
GetCPInfo
InterlockedDecrement
GetACP
GetOEMCP
IsValidCodePage
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
SetLastError
SetHandleCount
GetFileType
GetStartupInfoW
GetModuleFileNameA
FreeEnvironmentStringsW
WideCharToMultiByte
GetEnvironmentStringsW
QueryPerformanceCounter
GetCurrentProcessId
GetSystemTimeAsFileTime
LoadLibraryW
LCMapStringW
MultiByteToWideChar
GetStringTypeW
proxy_listener_start
proxy_listener_stop
Name
.text
Size
38KB
Virtual Size
37KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
9KB
Virtual Size
9KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
3KB
Virtual Size
10KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
1024B
Virtual Size
696B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
3KB
Virtual Size
3KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=22, id=171, productName=VS2010 build 30319, version=30319,
count=17, id=158, productName=VS2010 build 30319, version=30319,
count=88, id=170, productName=VS2010 build 30319, version=30319,
count=91, id=1, productName=Unmarked objects,
count=5, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=7, id=174, version=30319,
count=1, id=155, productName=VS2010 build 30319, version=30319,
count=1, id=157, productName=VS2010 build 30319, version=30319,