popup
Summary | ZeroBOX
  1. Home
  2. Result
  3. Report
  4. Detail Analysis

payload2.dll

AsyncRAT .NET framework(MSIL) UPX Malicious Library Malicious Packer PE File OS Processor Check PE32 .NET EXE
  1. Resubmit sample
Category Machine Started Completed
FILE s1_win7_x6401 June 21, 2023, 2:36 p.m. June 21, 2023, 2:38 p.m.
Size 45.0KB
Type PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
MD5 f249ab6266b09f71f05c85a966f8f3d7
SHA256 e22683de5510cbc523e79448c8695ae6c07e03b6548acbd8960ce243282594c0
CRC32 36005BD5
ssdeep 768:wuwCfTg46YbWUn8jjmo2qrl8khEamPIvFjbegX3ipgb089eHVTsOazHOuBDZmx:wuwCfTgp/28EaPvNbhXSpgbcVwjLOgdE
Yara
  • UPX_Zero - UPX packed file
  • OS_Processor_Check_Zero - OS Processor Check
  • Win32_Trojan_PWS_Net_1_Zero - Win32 Trojan PWS .NET Azorult
  • AsyncRat - AsyncRat Payload
  • Is_DotNET_EXE - (no description)
  • PE_Header_Zero - PE File Signature
  • Malicious_Library_Zero - Malicious_Library
  • Malicious_Packer_Zero - Malicious Packer
  • IsPE32 - (no description)

Name Response Post-Analysis Lookup
wbem.ddns.net
A 147.189.174.239
147.189.174.239
IP Address Status Action
147.189.174.239 Active Moloch
164.124.101.2 Active Moloch

Suricata Alerts

Flow SID Signature Category
UDP 192.168.56.101:59002 -> 164.124.101.2:53 2028675 ET POLICY DNS Query to DynDNS Domain *.ddns .net Potentially Bad Traffic

Suricata TLS

No Suricata TLS

domain wbem.ddns.net
dead_host 147.189.174.239:6666
Bkav W32.AIDetectNet.01
Lionic Trojan.Win32.Crysan.4!c
MicroWorld-eScan Generic.AsyncRAT.Marte.B.7713EB42
CAT-QuickHeal Trojan.IgenericFC.S14890850
ALYac Generic.AsyncRAT.Marte.B.7713EB42
Malwarebytes Generic.Trojan.MSIL.DDS
Zillya Trojan.Agent.Win32.1334302
Sangfor Suspicious.Win32.Save.a
K7AntiVirus Trojan ( 005678321 )
Alibaba Backdoor:MSIL/AsyncRat.c706b640
K7GW Trojan ( 005678321 )
CrowdStrike win/malicious_confidence_100% (W)
Arcabit Generic.AsyncRAT.Marte.B.7713EB42
VirIT Trojan.Win32.Genus.NFZ
Cyren W32/Samas.B.gen!Eldorado
Symantec Trojan.Gen.MBT
Elastic Windows.Trojan.Asyncrat
ESET-NOD32 a variant of MSIL/Agent.CFQ
Cynet Malicious (score: 100)
APEX Malicious
Paloalto generic.ml
ClamAV Win.Packed.Razy-9625918-0
Kaspersky HEUR:Backdoor.MSIL.Crysan.gen
BitDefender Generic.AsyncRAT.Marte.B.7713EB42
SUPERAntiSpyware Trojan.Agent/Gen-Kryptik
Avast Win32:DropperX-gen [Drp]
Tencent Trojan.Msil.Agent.zap
Emsisoft Trojan.Agent (A)
F-Secure Trojan.TR/Dropper.Gen
DrWeb Trojan.Siggen9.56514
VIPRE Generic.AsyncRAT.Marte.B.7713EB42
TrendMicro Backdoor.MSIL.ASYNCRAT.SMXSR
McAfee-GW-Edition BehavesLike.Win32.Fareit.pm
FireEye Generic.mg.f249ab6266b09f71
Sophos Troj/AsyncRat-B
SentinelOne Static AI - Malicious PE
Jiangmin Backdoor.MSIL.cxnh
Avira TR/Dropper.Gen
Antiy-AVL Trojan[Backdoor]/MSIL.Crysan
Gridinsoft Trojan.Win32.AsyncRAT.bot
Xcitium Malware@#agweq0isd79q
Microsoft Backdoor:MSIL/AsyncRat.AD!MTB
ViRobot Trojan.Win.Z.Agent.46080.KI
ZoneAlarm HEUR:Backdoor.MSIL.Crysan.gen
GData MSIL.Backdoor.DCRat.D
Google Detected
AhnLab-V3 Malware/Win32.RL_Generic.C3558490
Acronis suspicious
McAfee Fareit-FZT!F249AB6266B0
MAX malware (ai score=89)