popup
Summary | ZeroBOX
  1. Home
  2. Result
  3. Report
  4. Detail Analysis

unknown.exe

UPX Malicious Library Malicious Packer PWS PE File OS Processor Check PE32 .NET EXE
  1. Resubmit sample
Category Machine Started Completed
FILE s1_win7_x6403_us April 14, 2023, 9:27 a.m. April 14, 2023, 9:30 a.m.
Size 45.0KB
Type PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
MD5 a765f8edaa51aba85e51aa075cf73bf7
SHA256 ade73403409f6cef38c706e084b894e606275d9885bbac732dd23fa8d746f056
CRC32 88450C1E
ssdeep 768:Hu/6ZTgoiziWUUM9rmo2qrrKjGKG6PIyzjbFgX3isASagwbRS5A+ChBDZjx:Hu/6ZTgle2mKYDy3bCXS7PJRiA+Sdjx
Yara
  • UPX_Zero - UPX packed file
  • Malicious_Library_Zero - Malicious_Library
  • OS_Processor_Check_Zero - OS Processor Check
  • Win32_Trojan_PWS_Net_1_Zero - Win32 Trojan PWS .NET Azorult
  • Is_DotNET_EXE - (no description)
  • Malicious_Packer_Zero - Malicious Packer
  • Win_Backdoor_AsyncRAT_Zero - Win Backdoor AsyncRAT
  • IsPE32 - (no description)
  • PE_Header_Zero - PE File Signature

Name Response Post-Analysis Lookup
davidmalik07.ddns.net
A 5.249.165.85
5.249.165.85
IP Address Status Action
164.124.101.2 Active Moloch
5.249.165.85 Active Moloch

Suricata Alerts

Flow SID Signature Category
UDP 192.168.56.103:52760 -> 164.124.101.2:53 2028675 ET POLICY DNS Query to DynDNS Domain *.ddns .net Potentially Bad Traffic
TCP 5.249.165.85:6666 -> 192.168.56.103:49164 2030673 ET MALWARE Observed Malicious SSL Cert (AsyncRAT Server) Domain Observed Used for C2 Detected
TCP 5.249.165.85:6666 -> 192.168.56.103:49164 2035595 ET MALWARE Generic AsyncRAT Style SSL Cert Domain Observed Used for C2 Detected
TCP 5.249.165.85:6666 -> 192.168.56.103:49163 2030673 ET MALWARE Observed Malicious SSL Cert (AsyncRAT Server) Domain Observed Used for C2 Detected
TCP 5.249.165.85:6666 -> 192.168.56.103:49163 2035595 ET MALWARE Generic AsyncRAT Style SSL Cert Domain Observed Used for C2 Detected

Suricata TLS

Flow Issuer Subject Fingerprint
TLSv1
192.168.56.103:49164
5.249.165.85:6666 		CN=AsyncRAT Server CN=AsyncRAT Server a4:7d:b8:e1:fd:fa:97:f2:8b:75:31:24:d1:b5:03:fe:7d:a5:96:dc
TLSv1
192.168.56.103:49163
5.249.165.85:6666 		CN=AsyncRAT Server CN=AsyncRAT Server a4:7d:b8:e1:fd:fa:97:f2:8b:75:31:24:d1:b5:03:fe:7d:a5:96:dc

domain davidmalik07.ddns.net