popup
Summary | ZeroBOX
  1. Home
  2. Result
  3. Report
  4. Detail Analysis

28.txt.exe

AsyncRAT .NET framework(MSIL) UPX Malicious Library Malicious Packer .NET EXE PE File OS Processor Check PE32
  1. Resubmit sample
Category Machine Started Completed
FILE s1_win7_x6401 July 2, 2024, 9:45 a.m. July 2, 2024, 9:47 a.m.
Size 63.0KB
Type PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
MD5 3b2129194c379040d94f02260925b029
SHA256 63025373262924d8cf6755fc359fa04b19124e88dc8bd62b191ff8638be9f9fc
CRC32 717B4269
ssdeep 1536:PmImx6tX2kNff4sKu+UYF3lb2FBdAdUbxAPRSkTa6PaerPlTGBx:Pm9x6tmkN7Ku+UYF3l5UbxObb5d6x
Yara
  • Malicious_Library_Zero - Malicious_Library
  • PE_Header_Zero - PE File Signature
  • Malicious_Packer_Zero - Malicious Packer
  • AsyncRat - AsyncRat Payload
  • Is_DotNET_EXE - (no description)
  • IsPE32 - (no description)
  • Win32_Trojan_PWS_Net_1_Zero - Win32 Trojan PWS .NET Azorult
  • UPX_Zero - UPX packed file
  • OS_Processor_Check_Zero - OS Processor Check

Name Response Post-Analysis Lookup
wins26junspam.duckdns.org
A 191.93.112.233
191.93.112.233
IP Address Status Action
164.124.101.2 Active Moloch
191.93.112.233 Active Moloch

Suricata Alerts

Flow SID Signature Category
UDP 192.168.56.101:59002 -> 164.124.101.2:53 2042936 ET INFO DYNAMIC_DNS Query to a *.duckdns .org Domain Potentially Bad Traffic
UDP 192.168.56.101:59002 -> 164.124.101.2:53 2022918 ET INFO DYNAMIC_DNS Query to *.duckdns. Domain Misc activity

Suricata TLS

No Suricata TLS

domain wins26junspam.duckdns.org
Bkav W32.AIDetectMalware.CS
Elastic Windows.Generic.Threat
MicroWorld-eScan Generic.AsyncRAT.Marte.B.7F02B142
CAT-QuickHeal Backdoor.MsilFC.S14901152
Skyhigh BehavesLike.Win32.Fareit.km
ALYac Generic.AsyncRAT.Marte.B.7F02B142
Cylance Unsafe
VIPRE Generic.AsyncRAT.Marte.B.7F02B142
Sangfor Suspicious.Win32.Save.a
BitDefender Generic.AsyncRAT.Marte.B.7F02B142
Cybereason malicious.94c379
VirIT Trojan.Win32.MSIL_Heur.B
Symantec ML.Attribute.HighConfidence
ESET-NOD32 a variant of MSIL/AsyncRAT.A
APEX Malicious
McAfee PWS-FCQR!3B2129194C37
Avast Win32:DropperX-gen [Drp]
Kaspersky HEUR:Backdoor.MSIL.Crysan.gen
Rising Trojan.AntiVM!1.CF63 (CLASSIC)
Emsisoft Generic.AsyncRAT.Marte.B.7F02B142 (B)
F-Secure Trojan.TR/Dropper.Gen
DrWeb BackDoor.AsyncRATNET.2
McAfeeD ti!630253732629
FireEye Generic.mg.3b2129194c379040
Sophos Troj/AsyncRat-B
Ikarus Backdoor.AsyncRat
Jiangmin Trojan.Banker.MSIL.hol
Webroot W32.Dropper.Gen
Google Detected
Avira TR/Dropper.Gen
MAX malware (ai score=85)
Kingsoft malware.kb.c.1000
Arcabit Generic.AsyncRAT.Marte.B.7F02B142
ZoneAlarm HEUR:Backdoor.MSIL.Crysan.gen
GData MSIL.Backdoor.DCRat.D
Varist W32/Samas.B.gen!Eldorado
AhnLab-V3 Malware/Win32.RL_Generic.C4267562
BitDefenderTheta Gen:NN.ZemsilF.36808.dm0@aSmk2@h
DeepInstinct MALICIOUS
VBA32 OScope.Backdoor.MSIL.Crysan
Malwarebytes Generic.Malware.AI.DDS
Panda Trj/GdSda.A
Tencent Trojan.MSIL.Agent.kr
SentinelOne Static AI - Malicious PE
MaxSecure Trojan.Malware.300983.susgen
Fortinet MSIL/Agent.CFQ!tr
AVG Win32:DropperX-gen [Drp]
CrowdStrike win/malicious_confidence_100% (D)
alibabacloud Backdoor[rat]:MSIL/Agenttesla.Stub.LQL!MTB