popup
Summary | ZeroBOX
  1. Home
  2. Result
  3. Report
  4. Detail Analysis

cod.jpg_1.exe

AsyncRAT .NET framework(MSIL) UPX Malicious Packer PE File OS Processor Check PE32 .NET EXE
  1. Resubmit sample
Category Machine Started Completed
FILE s1_win7_x6401 Sept. 22, 2023, 9:34 a.m. Sept. 22, 2023, 9:36 a.m.
Size 66.0KB
Type PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
MD5 66f08e67109b6c6f161530d6f2e009d2
SHA256 792eed673f4c61948715751194f873bb80a837ce8efb4359fd537b8d7eb16421
CRC32 5F040248
ssdeep 1536:o2wukvF1ak9gcKu5UYFqY+jT4yXXUbrmtnE4nvtrQTGVx:o2dkvF1ak9Ku5UYFq7P4dbrmCAGex
Yara
  • UPX_Zero - UPX packed file
  • AsyncRat - AsyncRat Payload
  • PE_Header_Zero - PE File Signature
  • IsPE32 - (no description)
  • Is_DotNET_EXE - (no description)
  • Win32_Trojan_PWS_Net_1_Zero - Win32 Trojan PWS .NET Azorult
  • Malicious_Packer_Zero - Malicious Packer
  • OS_Processor_Check_Zero - OS Processor Check

Name Response Post-Analysis Lookup
josemonila.ddnsfree.com
A 95.214.27.64
95.214.27.64
IP Address Status Action
164.124.101.2 Active Moloch
95.214.27.64 Active Moloch

Suricata Alerts

Flow SID Signature Category
UDP 192.168.56.101:59002 -> 164.124.101.2:53 2046001 ET INFO DYNAMIC_DNS Query to a *.ddnsfree .com Domain Potentially Bad Traffic
TCP 95.214.27.64:8808 -> 192.168.56.101:49163 2030673 ET MALWARE Observed Malicious SSL Cert (AsyncRAT Server) Domain Observed Used for C2 Detected
TCP 95.214.27.64:8808 -> 192.168.56.101:49163 2035595 ET MALWARE Generic AsyncRAT Style SSL Cert Domain Observed Used for C2 Detected

Suricata TLS

Flow Issuer Subject Fingerprint
TLSv1
192.168.56.101:49163
95.214.27.64:8808 		CN=AsyncRAT Server CN=AsyncRAT Server c0:74:2f:cf:ac:08:26:95:4d:1f:b6:6f:1e:ab:22:b3:91:b1:75:90

No signatures