popup
Summary | ZeroBOX
  1. Home
  2. Result
  3. Report
  4. Detail Analysis

schtasks.exe

AsyncRAT .NET framework(MSIL) UPX Malicious Packer PE File OS Processor Check PE32 .NET EXE
  1. Resubmit sample
Category Machine Started Completed
FILE s1_win7_x6403_us July 12, 2023, 9:24 a.m. July 12, 2023, 9:27 a.m.
Size 66.0KB
Type PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
MD5 a0bcd3b7d2ab3ff1beb3ee7d87e736d0
SHA256 f6b520b1c3c5b2a936e9c76fbb80040fca9b8e1755b3ae54ad540c0fd21f8852
CRC32 07A24B81
ssdeep 1536:L2wukvF1ak9gcKu5UYF9l7fVb7skVzxv3lz66S8GVrPlTG9x:L2dkvF1ak9Ku5UYF9l7fVb37/lz6xNVC
Yara
  • UPX_Zero - UPX packed file
  • OS_Processor_Check_Zero - OS Processor Check
  • Win32_Trojan_PWS_Net_1_Zero - Win32 Trojan PWS .NET Azorult
  • AsyncRat - AsyncRat Payload
  • Is_DotNET_EXE - (no description)
  • PE_Header_Zero - PE File Signature
  • Malicious_Packer_Zero - Malicious Packer
  • IsPE32 - (no description)

Name Response Post-Analysis Lookup
azjulyosnftr5btinbm.ooguy.com
A 104.255.175.11
104.255.175.11
IP Address Status Action
104.255.175.11 Active Moloch
164.124.101.2 Active Moloch

Suricata Alerts

Flow SID Signature Category
TCP 104.255.175.11:9797 -> 192.168.56.103:49162 2030673 ET MALWARE Observed Malicious SSL Cert (AsyncRAT Server) Domain Observed Used for C2 Detected
TCP 104.255.175.11:9797 -> 192.168.56.103:49162 2035595 ET MALWARE Generic AsyncRAT Style SSL Cert Domain Observed Used for C2 Detected

Suricata TLS

Flow Issuer Subject Fingerprint
TLSv1
192.168.56.103:49162
104.255.175.11:9797 		CN=AsyncRAT Server CN=AsyncRAT Server c0:74:2f:cf:ac:08:26:95:4d:1f:b6:6f:1e:ab:22:b3:91:b1:75:90

No signatures