popup
Summary | ZeroBOX
  1. Home
  2. Result
  3. Report
  4. Detail Analysis

a3.jpg.exe

AsyncRAT .NET framework(MSIL) UPX Malicious Packer PE File OS Processor Check PE32 .NET EXE
  1. Resubmit sample
Category Machine Started Completed
FILE s1_win7_x6403_us Oct. 20, 2023, 4:33 p.m. Oct. 20, 2023, 4:35 p.m.
Size 66.0KB
Type PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
MD5 ca0299d9cfce19b30bedc50656f16983
SHA256 d39f638c0806471038d8e3e5991c659548fbaea5d2cb435fdec23aafe3bd32d5
CRC32 1B90079B
ssdeep 1536:FmfuSa/dSkDVMKuJUYFAcRHmp92fpbxzeFgwItGnl7GTjrQTGNx:FmGSa/dSkOKuJUYFA1IpbxC0Gl7GXGGx
Yara
  • UPX_Zero - UPX packed file
  • Malicious_Packer_Zero - Malicious Packer
  • AsyncRat - AsyncRat Payload
  • PE_Header_Zero - PE File Signature
  • IsPE32 - (no description)
  • Is_DotNET_EXE - (no description)
  • Win32_Trojan_PWS_Net_1_Zero - Win32 Trojan PWS .NET Azorult
  • OS_Processor_Check_Zero - OS Processor Check

Name Response Post-Analysis Lookup
rxrr.duckdns.org
A 185.81.157.213
185.81.157.213
IP Address Status Action
164.124.101.2 Active Moloch
185.81.157.213 Active Moloch

Suricata Alerts

Flow SID Signature Category
UDP 192.168.56.103:52760 -> 164.124.101.2:53 2042936 ET INFO DYNAMIC_DNS Query to a *.duckdns .org Domain Potentially Bad Traffic
UDP 192.168.56.103:52760 -> 164.124.101.2:53 2022918 ET INFO DYNAMIC_DNS Query to *.duckdns. Domain Misc activity
TCP 185.81.157.213:7707 -> 192.168.56.103:49165 2030673 ET MALWARE Observed Malicious SSL Cert (AsyncRAT Server) Domain Observed Used for C2 Detected
TCP 185.81.157.213:7707 -> 192.168.56.103:49165 2035595 ET MALWARE Generic AsyncRAT Style SSL Cert Domain Observed Used for C2 Detected

Suricata TLS

Flow Issuer Subject Fingerprint
TLSv1
192.168.56.103:49165
185.81.157.213:7707 		CN=AsyncRAT Server CN=AsyncRAT Server c0:74:2f:cf:ac:08:26:95:4d:1f:b6:6f:1e:ab:22:b3:91:b1:75:90

domain rxrr.duckdns.org