popup
Summary | ZeroBOX
  1. Home
  2. Result
  3. Report
  4. Detail Analysis

schtasks.exe

AsyncRAT .NET framework(MSIL) UPX Malicious Packer PE File OS Processor Check PE32 .NET EXE
  1. Resubmit sample
Category Machine Started Completed
FILE s1_win7_x6403_us July 11, 2023, 9:33 a.m. July 11, 2023, 9:35 a.m.
Size 66.0KB
Type PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
MD5 b32e6ee308372d87ba59b9e851b35972
SHA256 9863cc151fb5f2a429c3f8f51797814a8a895c0908dd798e3fae82895db25246
CRC32 26F52C0C
ssdeep 1536:TmfWSqHdykrVMKuJUYFbtRWlT0iQfbHrR3KdLbfLYJJUrPlTGlx:TmeSqHdykGKuJUYFBR6JWbHiLbfMJedM
Yara
  • UPX_Zero - UPX packed file
  • OS_Processor_Check_Zero - OS Processor Check
  • Win32_Trojan_PWS_Net_1_Zero - Win32 Trojan PWS .NET Azorult
  • AsyncRat - AsyncRat Payload
  • Is_DotNET_EXE - (no description)
  • PE_Header_Zero - PE File Signature
  • Malicious_Packer_Zero - Malicious Packer
  • IsPE32 - (no description)

Name Response Post-Analysis Lookup
No hosts contacted.
IP Address Status Action
45.12.253.107 Active Moloch

Suricata Alerts

Flow SID Signature Category
TCP 45.12.253.107:7707 -> 192.168.56.103:49163 2030673 ET MALWARE Observed Malicious SSL Cert (AsyncRAT Server) Domain Observed Used for C2 Detected
TCP 45.12.253.107:7707 -> 192.168.56.103:49163 2035595 ET MALWARE Generic AsyncRAT Style SSL Cert Domain Observed Used for C2 Detected

Suricata TLS

Flow Issuer Subject Fingerprint
TLSv1
192.168.56.103:49163
45.12.253.107:7707 		CN=AsyncRAT Server CN=AsyncRAT Server c0:74:2f:cf:ac:08:26:95:4d:1f:b6:6f:1e:ab:22:b3:91:b1:75:90

host 45.12.253.107