popup
Summary | ZeroBOX
  1. Home
  2. Result
  3. Report
  4. Detail Analysis

27.txt.exe

AsyncRAT .NET framework(MSIL) UPX Malicious Library Malicious Packer .NET EXE PE File OS Processor Check PE32
  1. Resubmit sample
Category Machine Started Completed
FILE s1_win7_x6402 July 2, 2024, 9:45 a.m. July 2, 2024, 9:48 a.m.
Size 63.0KB
Type PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
MD5 cfa3c233dbdff5cf57692484c4e50e6a
SHA256 db4ded7e203382cf90c69455577a23e0526a1b86b95675e59d7ede2362cce2c8
CRC32 549A1DF7
ssdeep 1536:TmImx6tX2kNff4sKu+UYFLCAOAfbaAPbF6VxnSrPlTGlx:Tm9x6tmkN7Ku+UYFOAffbaBVxSdmx
Yara
  • Malicious_Library_Zero - Malicious_Library
  • PE_Header_Zero - PE File Signature
  • Malicious_Packer_Zero - Malicious Packer
  • AsyncRat - AsyncRat Payload
  • Is_DotNET_EXE - (no description)
  • IsPE32 - (no description)
  • Win32_Trojan_PWS_Net_1_Zero - Win32 Trojan PWS .NET Azorult
  • UPX_Zero - UPX packed file
  • OS_Processor_Check_Zero - OS Processor Check

Name Response Post-Analysis Lookup
wins26junspam.duckdns.org
A 191.93.112.233
191.93.112.233
IP Address Status Action
164.124.101.2 Active Moloch
191.93.112.233 Active Moloch

Suricata Alerts

Flow SID Signature Category
UDP 192.168.56.102:63709 -> 164.124.101.2:53 2042936 ET INFO DYNAMIC_DNS Query to a *.duckdns .org Domain Potentially Bad Traffic
UDP 192.168.56.102:63709 -> 164.124.101.2:53 2022918 ET INFO DYNAMIC_DNS Query to *.duckdns. Domain Misc activity

Suricata TLS

No Suricata TLS

domain wins26junspam.duckdns.org
Bkav W32.AIDetectMalware.CS
Elastic Windows.Generic.Threat
CAT-QuickHeal Backdoor.MsilFC.S14901152
Skyhigh BehavesLike.Win32.Fareit.km
ALYac Generic.AsyncRAT.Marte.B.EE12E154
Cylance Unsafe
VIPRE Generic.AsyncRAT.Marte.B.EE12E154
Sangfor Suspicious.Win32.Save.a
BitDefender Generic.AsyncRAT.Marte.B.EE12E154
Cybereason malicious.3dbdff
Arcabit Generic.AsyncRAT.Marte.B.EE12E154
VirIT Trojan.Win32.MSIL_Heur.B
Symantec ML.Attribute.HighConfidence
ESET-NOD32 a variant of MSIL/AsyncRAT.A
APEX Malicious
McAfee PWS-FCQR!CFA3C233DBDF
Avast Win32:DropperX-gen [Drp]
ClamAV Win.Packed.Razy-9625918-0
Kaspersky HEUR:Backdoor.MSIL.Crysan.gen
MicroWorld-eScan Generic.AsyncRAT.Marte.B.EE12E154
Rising Trojan.AntiVM!1.CF63 (CLASSIC)
Emsisoft Generic.AsyncRAT.Marte.B.EE12E154 (B)
F-Secure Trojan.TR/Dropper.Gen
DrWeb BackDoor.AsyncRATNET.2
McAfeeD ti!DB4DED7E2033
FireEye Generic.mg.cfa3c233dbdff5cf
Sophos Troj/AsyncRat-B
Ikarus Backdoor.AsyncRat
Jiangmin Trojan.Banker.MSIL.hol
Webroot W32.Dropper.Gen
Google Detected
Avira TR/Dropper.Gen
MAX malware (ai score=87)
Kingsoft malware.kb.c.1000
Microsoft Backdoor:MSIL/AsyncRat.AD!MTB
ZoneAlarm HEUR:Backdoor.MSIL.Crysan.gen
GData MSIL.Backdoor.DCRat.D
Varist W32/Samas.B.gen!Eldorado
AhnLab-V3 Malware/Win32.RL_Generic.C4267562
BitDefenderTheta Gen:NN.ZemsilF.36808.dm0@aeyfNgn
DeepInstinct MALICIOUS
VBA32 OScope.Backdoor.MSIL.Crysan
Malwarebytes Generic.Malware.AI.DDS
Panda Trj/GdSda.A
Tencent Trojan.MSIL.Agent.kr
SentinelOne Static AI - Malicious PE
MaxSecure Trojan.Malware.300983.susgen
Fortinet MSIL/Agent.CFQ!tr
AVG Win32:DropperX-gen [Drp]
CrowdStrike win/malicious_confidence_100% (D)