popup
Summary | ZeroBOX
  1. Home
  2. Result
  3. Report
  4. Detail Analysis

schtasks.exe

AsyncRAT .NET framework(MSIL) UPX Malicious Packer PE File OS Processor Check PE32 .NET EXE
  1. Resubmit sample
Category Machine Started Completed
FILE s1_win7_x6403_us July 12, 2023, 8:11 a.m. July 12, 2023, 8:13 a.m.
Size 66.0KB
Type PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
MD5 25eb3575a5fdaefcf6f3b5c1d91c262d
SHA256 8f3e4102d729dd7d74f0a9e3071eaed5bc9221f895018921543199dac71df0ef
CRC32 18EB98D8
ssdeep 1536:32wukvF1ak9gcKu5UYFMB9JQRCbFHpg/AqQbGrPlTG5x:32dkvF1ak9Ku5UYFYDbFq4qPd6x
Yara
  • UPX_Zero - UPX packed file
  • OS_Processor_Check_Zero - OS Processor Check
  • Win32_Trojan_PWS_Net_1_Zero - Win32 Trojan PWS .NET Azorult
  • AsyncRat - AsyncRat Payload
  • Is_DotNET_EXE - (no description)
  • PE_Header_Zero - PE File Signature
  • Malicious_Packer_Zero - Malicious Packer
  • IsPE32 - (no description)

Name Response Post-Analysis Lookup
MARLI27.kozow.com
A 181.131.218.41
181.131.218.41
IP Address Status Action
164.124.101.2 Active Moloch
181.131.218.41 Active Moloch

Suricata Alerts

Flow SID Signature Category
TCP 181.131.218.41:2727 -> 192.168.56.103:49163 2030673 ET MALWARE Observed Malicious SSL Cert (AsyncRAT Server) Domain Observed Used for C2 Detected
TCP 181.131.218.41:2727 -> 192.168.56.103:49163 2035595 ET MALWARE Generic AsyncRAT Style SSL Cert Domain Observed Used for C2 Detected

Suricata TLS

Flow Issuer Subject Fingerprint
TLSv1
192.168.56.103:49163
181.131.218.41:2727 		CN=AsyncRAT Server CN=AsyncRAT Server c0:74:2f:cf:ac:08:26:95:4d:1f:b6:6f:1e:ab:22:b3:91:b1:75:90

No signatures