popup
Summary | ZeroBOX
  1. Home
  2. Result
  3. Report
  4. Detail Analysis

unknown.exe

UPX Malicious Packer PWS PE File OS Processor Check PE32 .NET EXE
  1. Resubmit sample
Category Machine Started Completed
FILE s1_win7_x6401 April 5, 2023, 10:17 a.m. April 5, 2023, 10:21 a.m.
Size 57.0KB
Type PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
MD5 0b0410a106ce1660cba2aabd69d150ac
SHA256 74bfeb73e3f972e2cc4605e22b84ef91789e97192ff04d6121dca43b9c556f3c
CRC32 02EA7B0F
ssdeep 1536:wwHa95Lv4GBu6cxH6GNn8EkYF/bdFw+xV3lEsK9Tx:wwHa95Lv4Uu6cxH6GN8JibdNxVVQJx
Yara
  • UPX_Zero - UPX packed file
  • OS_Processor_Check_Zero - OS Processor Check
  • Win32_Trojan_PWS_Net_1_Zero - Win32 Trojan PWS .NET Azorult
  • Is_DotNET_EXE - (no description)
  • Malicious_Packer_Zero - Malicious Packer
  • Win_Backdoor_AsyncRAT_Zero - Win Backdoor AsyncRAT
  • IsPE32 - (no description)
  • PE_Header_Zero - PE File Signature

Name Response Post-Analysis Lookup
xxxsexyxxx.dnsdojo.com
A 185.252.178.121
185.252.178.121
IP Address Status Action
164.124.101.2 Active Moloch
185.252.178.121 Active Moloch

Suricata Alerts

Flow SID Signature Category
UDP 192.168.56.101:59002 -> 164.124.101.2:53 2042691 ET INFO DYNAMIC_DNS Query to a *.dnsdojo .com Domain Potentially Bad Traffic
TCP 185.252.178.121:6126 -> 192.168.56.101:49163 2030673 ET MALWARE Observed Malicious SSL Cert (AsyncRAT Server) Domain Observed Used for C2 Detected
TCP 185.252.178.121:6126 -> 192.168.56.101:49163 2035595 ET MALWARE Generic AsyncRAT Style SSL Cert Domain Observed Used for C2 Detected

Suricata TLS

Flow Issuer Subject Fingerprint
TLSv1
192.168.56.101:49163
185.252.178.121:6126 		CN=AsyncRAT Server CN=AsyncRAT Server c0:74:2f:cf:ac:08:26:95:4d:1f:b6:6f:1e:ab:22:b3:91:b1:75:90

No signatures