AsyncRAT 0.5.6A.7z
- SHA256 2e4a8fe2039961a0df9a0f3d6b9ba861557c3b4e7a935d6c051277cda1d07246
Password
infected
Overview
overview
10Static
static
10AsyncRAT 0...AT.exe
windows11-ltsc_2024-x64
1AsyncRAT 0...xe.xml
windows11-ltsc_2024-x64
8AsyncRAT 0...at.dll
windows11-ltsc_2024-x64
1AsyncRAT 0...ra.dll
windows11-ltsc_2024-x64
8AsyncRAT 0...er.dll
windows11-ltsc_2024-x64
1AsyncRAT 0...er.dll
windows11-ltsc_2024-x64
8AsyncRAT 0...us.dll
windows11-ltsc_2024-x64
8AsyncRAT 0...ns.dll
windows11-ltsc_2024-x64
1AsyncRAT 0...er.dll
windows11-ltsc_2024-x64
1AsyncRAT 0...ry.dll
windows11-ltsc_2024-x64
1costura.dll
windows11-ltsc_2024-x64
8newtonsoft.json.dll
windows11-ltsc_2024-x64
1system.dat...te.dll
windows11-ltsc_2024-x64
8AsyncRAT 0...ra.dll
windows11-ltsc_2024-x64
1AsyncRAT 0...op.dll
windows11-ltsc_2024-x64
1AsyncRAT 0...le.dll
windows11-ltsc_2024-x64
1AsyncRAT 0...Me.txt
windows11-ltsc_2024-x64
1AsyncRAT 0...ub.exe
windows11-ltsc_2024-x64
10Behavioral task
behavioral1
Sample
AsyncRAT 0.5.6A/AsyncRAT.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
4 signatures
900 seconds
Behavioral task
behavioral2
Sample
AsyncRAT 0.5.6A/AsyncRAT.exe.xml
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
14 signatures
900 seconds
Behavioral task
behavioral3
Sample
AsyncRAT 0.5.6A/Plugins/Chat.dll
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
0 signatures
900 seconds
Behavioral task
behavioral4
Sample
AsyncRAT 0.5.6A/Plugins/Extra.dll
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
14 signatures
900 seconds
Behavioral task
behavioral5
Sample
AsyncRAT 0.5.6A/Plugins/FileManager.dll
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
0 signatures
900 seconds
Behavioral task
behavioral6
Sample
AsyncRAT 0.5.6A/Plugins/LimeLogger.dll
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
14 signatures
900 seconds
Behavioral task
behavioral7
Sample
AsyncRAT 0.5.6A/Plugins/Miscellaneous.dll
Resource
win11ltsc2024-20260710-en
windows11-ltsc_2024-x64
14 signatures
900 seconds
Behavioral task
behavioral8
Sample
AsyncRAT 0.5.6A/Plugins/Options.dll
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
0 signatures
900 seconds
Behavioral task
behavioral9
Sample
AsyncRAT 0.5.6A/Plugins/ProcessManager.dll
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
0 signatures
900 seconds
Behavioral task
behavioral10
Sample
AsyncRAT 0.5.6A/Plugins/Recovery.dll
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
0 signatures
900 seconds
Behavioral task
behavioral11
Sample
costura.dll
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
14 signatures
900 seconds
Behavioral task
behavioral12
Sample
newtonsoft.json.dll
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
0 signatures
900 seconds
Behavioral task
behavioral13
Sample
system.data.sqlite.dll
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
14 signatures
900 seconds
Behavioral task
behavioral14
Sample
AsyncRAT 0.5.6A/Plugins/RemoteCamera.dll
Resource
win11ltsc2024-20260710-en
windows11-ltsc_2024-x64
0 signatures
900 seconds
Behavioral task
behavioral15
Sample
AsyncRAT 0.5.6A/Plugins/RemoteDesktop.dll
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
0 signatures
900 seconds
Behavioral task
behavioral16
Sample
AsyncRAT 0.5.6A/Plugins/SendFile.dll
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
0 signatures
900 seconds
Behavioral task
behavioral17
Sample
AsyncRAT 0.5.6A/ReadMe.txt
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
0 signatures
900 seconds
General
- Target AsyncRAT 0.5.6A.7z
- Size 4.2MB
- Sample260724-nbfeksxyez
- SHA256 2e4a8fe2039961a0df9a0f3d6b9ba861557c3b4e7a935d6c051277cda1d07246
- MD5 4aa0872bbfe35a5a7129bec72e8bfa5a
- SHA1 b009407fe443a9f73be138c864f144297daa5ece
- SHA512 dd60218f2dfa71c5ee649d17cc1e7f66600866ca5a113991820c0cd1dcb1a5a3c4d120ffb21171674dab85460f9a6bd012f0996620662ab1a9d1551d10d43076
- SSDEEP 98304:2q6K12PX0fywd2ZuxuuUfzgpJnfHT8vmOr7P68UonLLAVV:76Kb6rusz+Af3C8NiV
- TLSH T1A71633E06C87F0ED45E67B0BD0CB2A966CD4EC500EC186F5C3BD5D5AEB8F115258AAC4
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Async RAT payload 1 IoCs
resource yara_rule static1/unpack001/AsyncRAT 0.5.6A/Stub/Stub.exe family_asyncrat - Unsigned PE 15 IoCs
Checks for missing Authenticode signature.
resource unpack001/AsyncRAT 0.5.6A/AsyncRAT.exe unpack001/AsyncRAT 0.5.6A/Plugins/Chat.dll unpack001/AsyncRAT 0.5.6A/Plugins/Extra.dll unpack001/AsyncRAT 0.5.6A/Plugins/FileManager.dll unpack001/AsyncRAT 0.5.6A/Plugins/LimeLogger.dll unpack001/AsyncRAT 0.5.6A/Plugins/Miscellaneous.dll unpack001/AsyncRAT 0.5.6A/Plugins/Options.dll unpack001/AsyncRAT 0.5.6A/Plugins/ProcessManager.dll unpack001/AsyncRAT 0.5.6A/Plugins/Recovery.dll unpack002/costura.dll unpack002/system.data.sqlite.dll unpack001/AsyncRAT 0.5.6A/Plugins/RemoteCamera.dll unpack001/AsyncRAT 0.5.6A/Plugins/RemoteDesktop.dll unpack001/AsyncRAT 0.5.6A/Plugins/SendFile.dll unpack001/AsyncRAT 0.5.6A/Stub/Stub.exe
File Explorer
-
AsyncRAT 0.5.6A.7z.7z 4.2MB
-
AsyncRAT 0.5.6A/AsyncRAT.exe.exe 10.3MB
-
AsyncRAT 0.5.6A/AsyncRAT.exe.config.xml 5KB
-
AsyncRAT 0.5.6A/Plugins/Chat.dll.dll 103KB
-
AsyncRAT 0.5.6A/Plugins/Extra.dll.dll 102KB
-
AsyncRAT 0.5.6A/Plugins/FileManager.dll.dll 119KB
-
AsyncRAT 0.5.6A/Plugins/LimeLogger.dll.dll 104KB
-
AsyncRAT 0.5.6A/Plugins/Miscellaneous.dll.dll 284KB
-
AsyncRAT 0.5.6A/Plugins/Options.dll.dll 114KB
-
AsyncRAT 0.5.6A/Plugins/ProcessManager.dll.dll 98KB
-
AsyncRAT 0.5.6A/Plugins/Recovery.dll.dll 386KB
-
costura.dll.dll 4KB
-
newtonsoft.json.dll.dll 541KB
-
system.data.sqlite.dll.dll 352KB
-
AsyncRAT 0.5.6A/Plugins/RemoteCamera.dll.dll 180KB
-
AsyncRAT 0.5.6A/Plugins/RemoteDesktop.dll.dll 116KB
-
AsyncRAT 0.5.6A/Plugins/SendFile.dll.dll 127KB
-
AsyncRAT 0.5.6A/ReadMe.txt135B
-
AsyncRAT 0.5.6A/Stub/Stub.exe.exe 38KB
AsyncRAT 0.5.6A/AsyncRAT.exe
- IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
- SHA256 deec8c8c9b2d3eeaf1e3117a6c5565875e046701513365d8a19932347e170507
- MD5 f2be5522a4a50e5333e04521ad4a8810
- SHA1 c889b1dcb66a0e022de3b09e2f12ae8257e4d21d
- SHA512 4c67054ffea09bb1d9439ba7e93d92c593fcc56308872aef792d4bb3ed97b641be332e0006b1599eced5a67a3ead30b84831b89f9328d833cc74869397a7dac7
- SSDEEP 98304:GLhwZmt3Z2C/G2obbPmDVa3VxobFOeN5xXhAqin1F1La67dos6bI0LO6rR4P6zQ:GLhZ3/pc7aIteN5htinX1B7Z0/i
- TLSH T186B69E21FAE48167F076E6F6B0A126359EB0AE396F21EBBB554037580CF27417C15B23
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
10724746
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
PDB paths
mscoree
_CorExeMain
Name
.text
Size
10.2MB
Virtual Size
10.2MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
31KB
Virtual Size
30KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
AsyncRAT 0.5.6A/AsyncRAT.exe.config
- SHA256 63d3d2d75e6334c1e4f9687e55e868d16eb7853a67152a0d251a45b1a8a3e373
- MD5 8ecf2a4592ab9bf5c9add5c61621cc0d
- SHA1 cea203ad2cf09f5dc0b7dca7b9f5de4f9876ba85
- SHA512 5339c1f701985e0ce45dd5200b35027f53b402fcc0cb86ae758767afbc45bb6fdbce73d57f223024fb0df83627b443d49011b52a62368fdab5eabbe8cffb1a51
- SSDEEP 96:ur71Y7KY7KPrv0bGiver/apdgaRzV6RnwhXJ0bGiveLapdgaRzV6RQyYKS4YpyMS:ur7S7L7OrTaCyYKS/pvrsJ+J/qJvr
- TLSH T1D2B1E608A5C15EDA02362B32EB3052C5EDA006631176B4F478ED31679F71CDA5BB33B6
- MD5 SHA1 SHA512 SSDEEP TLSH
AsyncRAT 0.5.6A/Plugins/Chat.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 4bc1d1685efdffd62a92f4c3a11075c4070fd52c9b210f70ca1a0ae1e41895a1
- MD5 bd5675784241fc8a1b16cc7be4e204c1
- SHA1 62c64535c4b9ef068cc4a7b14ed642ac921b8b24
- SHA512 b4a9efbf1c3606b12ccccd2370f02e7f7d5266b37d80227b6d37beac807be1dc48470eb99388a8d08b0cfef1c792514dc0e24a1f0f227c0818b55291b87e6953
- SSDEEP 1536:07hNeRCrOuH4ds9nD/JufV5cbrrG923s0M/aGG4AF48x/A:0FgE1z95bXG923s0M/aGG4AF48lA
- TLSH T1BCA3EB9C765076DFC85BC872DEA81C64EA60B4BB531BC203A02316ED9A0D99BCF151F3
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
111502
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
mscoree
_CorDllMain
Name
.text
Size
101KB
Virtual Size
100KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
808B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
AsyncRAT 0.5.6A/Plugins/Extra.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 682c3d0c99ab1922ab31f792f3af490f443b27d5065383d4f5647e29c1098a68
- MD5 1e7748688cf0045a0d60f04ea9be3257
- SHA1 1f880f2224ccec9e1958f493e88932612131e3ad
- SHA512 e8a91b2d0eb81b6903fc02cdaf30d1374c12de3544e004c112f9763db69685be4e26fe6f7274355d533100c42ee18627bf07d6156d5014b87a26bf0c396e31f4
- SSDEEP 1536:g5DQB4/7Ll0w40uXzblrAHuQ6WVLpsGzSGhNpasBX:oGiL6jDSuJusGzSGhNpasBX
- TLSH T119A3DB9D765076DFC85BC876DEA82C64EA60747B531BC203A05316ADEA0D99BCF140F3
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
111054
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
mscoree
_CorDllMain
Name
.text
Size
100KB
Virtual Size
100KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
808B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
AsyncRAT 0.5.6A/Plugins/FileManager.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 917263fb9dd4c87d01b4f6732446e630c14bc7cc37ca5e402bcc4197b3ce5f23
- MD5 2aabd94c57e84728e05f864fde3f9f2c
- SHA1 aa23bed2342eaf3cbcffdd386aab3b8a708aa700
- SHA512 d466f3463b0ca2ed135765480b1a63b0d7d6fae8912d65abb441d3782a069f563e5d8eb564cb19f1168b4658598c84c329e9e3af6620a97998c318a15d0a3ce9
- SSDEEP 3072:xmYqCH2B9Fh8lbienuYQnr70vpEiidP/w:xmxCWBzh8lbienuYQr70vpEiidP
- TLSH T12BC3DCAC765076DFC85BC872DEA81C64EA50747B931F9203A06316EDAA0D99BCF150F3
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
128270
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
mscoree
_CorDllMain
Name
.text
Size
117KB
Virtual Size
117KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
688B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
AsyncRAT 0.5.6A/Plugins/LimeLogger.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 5d47d0b448232b2d94f6546d7da86c1ee02f027289e94c83d39beaac74cc9b82
- MD5 d968b1cd70cc599233dbe5c35f61a76d
- SHA1 a4daa3e4e6f8ca06e32c2122679bd3bf2d14f294
- SHA512 2ecc139506db944e0acb77a10ab7f8f59c3de5650af9ddfd979de460faffd35c1b4c35af9d5e57ac5c02467d8166f8ea611881e15310dea3e1c5276641d288ea
- SSDEEP 1536:BHNQB4/rzlUpVQtAMRshMGw/EwuX5ncYs8NlJZMoG4zKrvcp:bGSzKOueGIU5ncYs8bJZMoG4zKrvcp
- TLSH T179A3BCAD766075DFC85BC872CEA81D64EA50B47B531F8203A05326ADAA0D9DBCF150F3
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
112814
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
mscoree
_CorDllMain
Name
.text
Size
102KB
Virtual Size
102KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
832B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
AsyncRAT 0.5.6A/Plugins/Miscellaneous.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 b5bfc444f45953d8b50674c1a9e384680dfe6d0ce3e2e6bd5d5131aa399d1e5e
- MD5 9706f711a300f5960bbf6088ddeb6ea1
- SHA1 5e2691cca910b54358d0403f392fd7857e7ca276
- SHA512 86f98f1a404b8349821b70e818202b0fecff3c48dcb4db9b782ba790b6fd4e28c0f8d1adfcb96efd6875fdd8cb710fdadd0a7be8a8095d34a91185eb70043b84
- SSDEEP 6144:N5bjlfT28/sxrh8juJdbKj/eCqdGgPDXkJNk4/L4xa6Mxc0YP7AXAwWvWQFHHVDc:NdOrh8judgeCqdGgPDXkJNk4/L4xa6Ml
- TLSH T1AE54BAAD765072DFC85BC872DEA81C64EA60747B431F9203A06716EDAE0D99BDF140F2
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
297134
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
mscoree
_CorDllMain
Name
.text
Size
282KB
Virtual Size
282KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
696B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
AsyncRAT 0.5.6A/Plugins/Options.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 d19b5e64ee542bf79be61d99688c0c8e976d46900fa5fee74f5d4604fbbb11da
- MD5 232b4a3e80932831b09e32f11cfb305d
- SHA1 a273005581ec4d7f3ebffe8d565dae3205d8c07e
- SHA512 8732eab6d32a3bb12535c42fa09b01d270078ca69a30a7230ed918d4d05eaa92308dacc5df2c67aec919efce13e09c1ed00618416713b9d6be2fee3dd8f7184b
- SSDEEP 3072:gGWtCyJN/j34nHHR57FhaH4bQU8kihuhb9y4n8y:grA0Nr3ynR57FhaH4bQUPihuhb9y4
- TLSH T1A0B3CC9D766076DFC85BC876CEA82C64EA60747B531BD203A05316EDEA0D99BCF140F2
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
122462
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
mscoree
_CorDllMain
Name
.text
Size
112KB
Virtual Size
111KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
816B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
AsyncRAT 0.5.6A/Plugins/ProcessManager.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 7d042a901455bbe545b112413e6e02e018431d2ee690d1fe876619603d412545
- MD5 6851e64d70978426d01277581abc382e
- SHA1 30e12bbb4477966a250aafabbf3698a865440539
- SHA512 0da65947fb979791a0920cd8560e8d15235f52c9737164adeb382e4f78bba83940db255e1a794286cb18082c28fbe65dcc13704edb30698e4cbd8eb964bbdbe4
- SSDEEP 1536:eBLy4WuJu0Hf0/4Z1IzDfC6VinGDJhcOVfDbAhxg:im9X0cmmDfLinGDJhcOVfDbAhq
- TLSH T1DCA3EC9D366076DFC85BC872DEA81C64EA50747B531BC343A06326EDAA0D99BCF150F2
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
106494
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
mscoree
_CorDllMain
Name
.text
Size
96KB
Virtual Size
96KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
848B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
AsyncRAT 0.5.6A/Plugins/Recovery.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 f978342fae093915385ada5097b6fc014cee9d230f9f835bcad375c7556a55a0
- MD5 b14c9f7613c6b0e138e531135368afeb
- SHA1 9fea569af6d1b977a49bdbebbd09eea0a3681933
- SHA512 704c7fa6de6dba6be22ba109b8ad3a71a1682fdda894a0a9891ea34f95014a9ab88d4dfffbd3c7e0cfa776a795566ed7db02c7350483403bb9fcdfe5532f7406
- SSDEEP 12288:ulwsHTQwEKaAn9BRWTCbd1WX84C87ciQDZwCo:UJaAn9Bw+T4N/QNw
- TLSH T16A841252EB7D825ACBAD0E38E8B070185374B157A912E74E5DC4C8EA167BFD60063F87
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
401550
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
mscoree
_CorDllMain
Name
.text
Size
384KB
Virtual Size
384KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
824B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
costura.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 9e0d68e4a15788ca1464ee024b3422cfdf8a68bc9058ad0d9c6bc91614935eed
- MD5 d075a47a551e53e27889f83670a581e1
- SHA1 5954e332ec7732ba34c27e2d88d154d1919c1b07
- SHA512 d2f2ca4358102cb0d3cb90c1cebe9aa2cb2c6fb21facdf3471c50ab72d6ac907e789bb918508539c34c10fc948792c68f67363eb755b80a2343bd72dc9e93c0e
- TLSH T1CA81632193B8067AE9770FB29D7B03516375F921ED32C73F595561096C273248E72B32
- MD5 SHA1 SHA512 TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
10210
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
C:\projects\costura\Costura\obj\Release\net40\Costura.pdb
mscoree
_CorDllMain
Name
.text
Size
2KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
992B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
newtonsoft.json.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 56032ade45ccf8f4c259a2e57487124cf448a90bca2eeb430da2722d9e109583
- MD5 9de86cdf74a30602d6baa7affc8c4a0f
- SHA1 9c79b6fbf85b8b87dd781b20fc38ba2ac0664143
- SHA512 dca0f6078df789bb8c61ffb095d78f564bfc3223c6795ec88aeb5f132c014c5e3cb1bd8268f1e5dc96d7302c7f3de97e73807f3583cb4a320d7adbe93f432641
- SSDEEP 6144:+lLkxTZNddfQr7w9Tckw+CQuahz0PQ78X/Wva/KFWi9Mb5hijnFrBV9r3iCGH5jY:+ybNxFxhPRGeLByjfjuGO
- TLSH T124C45B2127FD9726D9EE2334F430490A87F6F406B27AE78FA941D5A91C93B915C107B3
- MD5 SHA1 SHA512 SSDEEP TLSH
Digest
cc:05:c9:c3:a9:22:61:97:44:e8:2a:e7:1e:56:4f:79:0c:fd:49:70:32:5d:0d:03:74:8b:82:e2:14:41:65:eb
Digest Algorithm
sha256
PE Digests Matches
Trusted
Signing Certificate
SERIALNUMBER=603 389 068,CN=Json.NET (.NET Foundation),O=Json.NET (.NET Foundation),L=Redmond,ST=wa,C=US
Chains
Apr 22, 2019
SERIALNUMBER=603 389 068,CN=Json.NET (.NET Foundation),O=Json.NET (.NET Foundation),L=Redmond,ST=wa,C=US
CN=.NET Foundation Projects Code Signing CA,O=.NET Foundation,C=US
CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Subject
CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Serial Number
02:ac:5c:26:6a:0b:40:9b:8f:0b:79:f2:ae:46:25:77
Issuer
CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Revocation Status
Not revoked
Timespan
Nov 10, 2006 - Nov 10, 2031
Subject
CN=.NET Foundation Projects Code Signing CA,O=.NET Foundation,C=US
Serial Number
07:b0:41:8d:a5:1e:14:8c:33:1b:bc:de:b7:13:83:23
Issuer
CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageCodeSigning
Revocation Status
Not revoked
Timespan
Apr 27, 2018 - Apr 27, 2028
Subject
SERIALNUMBER=603 389 068,CN=Json.NET (.NET Foundation),O=Json.NET (.NET Foundation),L=Redmond,ST=wa,C=US
Serial Number
0a:71:a1:b0:c2:96:f5:c7:90:65:47:0a:3c:20:53:7e
Issuer
CN=.NET Foundation Projects Code Signing CA,O=.NET Foundation,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageCodeSigning
Revocation Status
Not revoked
Timespan
Oct 25, 2018 - Oct 29, 2021
Subject
CN=DigiCert SHA2 Timestamp Responder,O=DigiCert,C=US
Serial Number
09:c0:fc:46:c8:04:42:13:b5:59:8b:af:28:4f:4e:41
Issuer
CN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageTimeStamping
Revocation Status
Not revoked
Timespan
Jan 4, 2017 - Jan 18, 2028
Subject
CN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Serial Number
0a:a1:25:d6:d6:32:1b:7e:41:e4:05:da:36:97:c2:15
Issuer
CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Revocation Status
Not revoked
Timespan
Jan 7, 2016 - Jan 7, 2031
Minor OS version
0
Major OS version
4
Entry point
551278
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
/_/Src/Newtonsoft.Json/obj/Release/net40/Newtonsoft.Json.pdb
mscoree
_CorDllMain
Name
.text
Size
531KB
Virtual Size
530KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
system.data.sqlite.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 3f5704c66bd6b9947e3b34959a514fda769915fe680d162589023ae6d8ca2cfc
- MD5 58a93b89919bc9a347f9ca0c67e9061b
- SHA1 051ce32517c083acf8978eab424837254de62af0
- SHA512 31de64141b4fb19de59d1360dd9def1087a6502791f9cfa2b835009b0ff95c1d21ad46f79ed1df37d12ead77babe169327c2689250d46de8094de2eed51dc70f
- SSDEEP 6144:PgX7zPMNAJRDQ1NfroGz1HcsQ+tVmHuvrFNFaFeFOFwcGF6cmFWc0FWc8cIcKcUI:U4NAQcyzFNFaFeFOFwcGF6cmFWc0FWcH
- TLSH T14B744A9423DC360AE2FF8778E4B116408771F46695ABE31E78C150BE1D2BB44A953BB3
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
365854
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
c:\dev\sqlite\dotnet\obj\2010\System.Data.SQLite.2010\Release\System.Data.SQLite.pdb
mscoree
_CorDllMain
Name
.text
Size
349KB
Virtual Size
349KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
AsyncRAT 0.5.6A/Plugins/RemoteCamera.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 aaaed3eb57964c9a28508e3734d4adbe0511c758db97bc41bb6fa49a003ab801
- MD5 d0bfb8048c7624f87896460b271a6867
- SHA1 4140845ef14d58abd42ed602d8a10893f597feac
- SHA512 725395e5cc1e5cc27af958d61b74316f3ad97ee357db01f1456976f1d7914f295be33d0979a85178757d14ea564400a429a070bbf4458ad75dd8acc61d9827cf
- SSDEEP 3072:BesOciPIjNWYK6eXLQ/IpnsM9nLWQtkSXfd/nKv+Oc0of0LR6+Cp/:BpjikNWYK9XLHpnsaLWQtkifd/nKv+O4
- TLSH T1A204FD9D365076DFC85BC972DEA81D64EB6074BB530B9203A06316EDAE0D99BCF140F2
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
190782
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
mscoree
_CorDllMain
Name
.text
Size
178KB
Virtual Size
178KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
840B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
AsyncRAT 0.5.6A/Plugins/RemoteDesktop.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 33d87ccca43de4fe76c239784e4f66097c2fad874566740893f76757dd126b2a
- MD5 21d0738eff33850193e3dd887e68c4e8
- SHA1 fe5e0031796d566d71bc30e0a1cb5e22c79be7a4
- SHA512 390310bf064adf8f5080b4780a2b0a2d83d268d491124ecea0a9bd9fdc031273e1db30c20b4ab7296288ca40831d2b8f88a3795d9d8e0d3ae2a03aacef94305a
- SSDEEP 1536:ivPyJ5VuBSu93gyIXSKNcJIeGXA5HqlhSFLWe:i3cqBSu9QyIXSFIe8A5HqlhSFLWe
- TLSH T19CC31EAC765076DFC85BC872DEA81C64EA60B47B530BD303A45326AD9A0D99BCF150F3
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
124766
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
mscoree
_CorDllMain
Name
.text
Size
114KB
Virtual Size
113KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
840B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
AsyncRAT 0.5.6A/Plugins/SendFile.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 9c1350f59d063cf75326f40277c6c5ba527ecf5e08540dc5f23fb20e4c0d2af0
- MD5 d6b036e3b086cbdc05a60fbc9353e4f6
- SHA1 ab485ec752b9c4a0f537d0dc7ca54c500e42f49f
- SHA512 ba26a3147928877237f137748cddf74eb5f1948467c9c22d8d04127681f551cd25fa11664b6a446b390bf70f6a8da37a990d136a36cbae57230ef5ed73498879
- SSDEEP 3072:kTnQUJKS4bL4BmlFJ716qPftxNsv+OXom8M:kj5JKZL4kfJ716qPf7Nsv+OXoT
- TLSH T132D3AAAD765076DFC85BC872DEA82C64EA50747B931F9203A05316EDEA0D99BCF140F2
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
136414
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
mscoree
_CorDllMain
Name
.text
Size
125KB
Virtual Size
125KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
824B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
AsyncRAT 0.5.6A/ReadMe.txt
- SHA256 3dd9d0dcc3a7f6be882dee7640837a9b0f6ccc90ca2aa4e7f6d40be4f83ded74
- MD5 5d1be0374017d2d86463c447ac520267
- SHA1 637840d2d90643296b25c4d70b695765f8ec5095
- SHA512 64ac0783f1083f08e3acb762e335d174f0e523d20391c3ab04a651d305d4e01d33cbc33a4f019a6119ae673aa9821d3078d04a49c5130bb773c31317df037e9b
- TLSH T169C02BCB43D30320C2ADF4F005019051B4014476314B3B41321980E28280234841091C
- MD5 SHA1 SHA512 TLSH
AsyncRAT 0.5.6A/Stub/Stub.exe
- IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
- SHA256 a812bb930c3dbd7738e8eb43b5113d0f6d12c41a37a2c69ecce59f5310a083ca
- MD5 2bd96f328b68163376690327b79840e1
- SHA1 412f6aa18e3408d65d71c6c972c2796b3b922ea2
- SHA512 7d1e26b0a6708e7c875283f334f6ee21ef18fc47b7cd503dd482bd69dd3117c14f1a4cbaa4976e087057d5600be11c8653a8a3d1c4819b3339a94ef1957a66a0
- SSDEEP 768:/BTDJHziZBmMOC0BRfeWeFKnQmMPbPgF0qWeuN4FhtYcFmVc6K:/PBYC5ub4FrWPkRmVcl
- TLSH T1D9032B0037E88366D2FD4BBCA872420493B1D5272513DB5A7DCC94EE6B237CB9612BD6
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Async RAT payload
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
42150
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
mscoree
_CorExeMain
Name
.text
Size
33KB
Virtual Size
33KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
4KB
Virtual Size
3KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ