popup
Summary | ZeroBOX
  1. Home
  2. Result
  3. Report
  4. Detail Analysis

s.exe

AsyncRAT .NET framework(MSIL) UPX Malicious Packer PE File OS Processor Check PE32 .NET EXE
  1. Resubmit sample
Category Machine Started Completed
FILE s1_win7_x6403_us July 20, 2023, 9:32 a.m. July 20, 2023, 9:34 a.m.
Size 66.0KB
Type PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
MD5 ab7af1b5d04d9f284f2b9d5f6eae2ff1
SHA256 3d1cfc04cd1a428bf738090ca3c2511315f173dca970dfe1be2038c2b2eee37f
CRC32 13317894
ssdeep 1536:72wukvF1ak9gcKu5UYFCbanNuQ3N6euyb/75EgohFVSKrmTGVx:72dkvF1ak9Ku5UYFTNketb/75iREex
Yara
  • UPX_Zero - UPX packed file
  • OS_Processor_Check_Zero - OS Processor Check
  • Win32_Trojan_PWS_Net_1_Zero - Win32 Trojan PWS .NET Azorult
  • AsyncRat - AsyncRat Payload
  • Is_DotNET_EXE - (no description)
  • PE_Header_Zero - PE File Signature
  • Malicious_Packer_Zero - Malicious Packer
  • IsPE32 - (no description)

Name Response Post-Analysis Lookup
jobsearchtest.com
A 139.99.3.41
139.99.3.41
IP Address Status Action
139.99.3.41 Active Moloch
164.124.101.2 Active Moloch

Suricata Alerts

Flow SID Signature Category
TCP 139.99.3.41:7707 -> 192.168.56.103:49162 2030673 ET MALWARE Observed Malicious SSL Cert (AsyncRAT Server) Domain Observed Used for C2 Detected
TCP 139.99.3.41:7707 -> 192.168.56.103:49162 2035595 ET MALWARE Generic AsyncRAT Style SSL Cert Domain Observed Used for C2 Detected

Suricata TLS

Flow Issuer Subject Fingerprint
TLSv1
192.168.56.103:49162
139.99.3.41:7707 		CN=AsyncRAT Server CN=AsyncRAT Server c0:74:2f:cf:ac:08:26:95:4d:1f:b6:6f:1e:ab:22:b3:91:b1:75:90

No signatures