popup
Summary | ZeroBOX
  1. Home
  2. Result
  3. Report
  4. Detail Analysis

schtasks.exe

AsyncRAT .NET framework(MSIL) UPX Malicious Packer PE File OS Processor Check PE32 .NET EXE
  1. Resubmit sample
Category Machine Started Completed
FILE s1_win7_x6403_us Aug. 3, 2023, 10:14 a.m. Aug. 3, 2023, 10:18 a.m.
Size 66.0KB
Type PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
MD5 ef85c294d69ed1cc66f26b7ea200b425
SHA256 617766f8acf5a0d678581423c56cd97f5006b47626b5f1a9963b9b14e653fcb6
CRC32 7591CC58
ssdeep 1536:K2wmkPN1ak1gcKu5UYFkNfi2GhblU1GJI2/2gWrmTGxx:K21kPN1ak1Ku5UYF0fi9hblU15nFECx
Yara
  • UPX_Zero - UPX packed file
  • OS_Processor_Check_Zero - OS Processor Check
  • Win32_Trojan_PWS_Net_1_Zero - Win32 Trojan PWS .NET Azorult
  • AsyncRat - AsyncRat Payload
  • Is_DotNET_EXE - (no description)
  • PE_Header_Zero - PE File Signature
  • Malicious_Packer_Zero - Malicious Packer
  • IsPE32 - (no description)

Name Response Post-Analysis Lookup
esxo.ddnsfree.com
A 185.81.114.175
185.81.114.175
IP Address Status Action
164.124.101.2 Active Moloch
185.81.114.175 Active Moloch

Suricata Alerts

Flow SID Signature Category
UDP 192.168.56.103:52760 -> 164.124.101.2:53 2046001 ET INFO DYNAMIC_DNS Query to a *.ddnsfree .com Domain Potentially Bad Traffic
TCP 185.81.114.175:8808 -> 192.168.56.103:49163 2030673 ET MALWARE Observed Malicious SSL Cert (AsyncRAT Server) Domain Observed Used for C2 Detected
TCP 185.81.114.175:8808 -> 192.168.56.103:49163 2035595 ET MALWARE Generic AsyncRAT Style SSL Cert Domain Observed Used for C2 Detected

Suricata TLS

Flow Issuer Subject Fingerprint
TLSv1
192.168.56.103:49163
185.81.114.175:8808 		CN=AsyncRAT Server CN=AsyncRAT Server c0:74:2f:cf:ac:08:26:95:4d:1f:b6:6f:1e:ab:22:b3:91:b1:75:90

No signatures