popup
Summary | ZeroBOX
  1. Home
  2. Result
  3. Report
  4. Detail Analysis

sc2.exe

AsyncRAT .NET framework(MSIL) UPX Malicious Library Malicious Packer .NET EXE PE File OS Processor Check PE32
  1. Resubmit sample
Category Machine Started Completed
FILE s1_win7_x6403_us July 18, 2024, 8:24 a.m. July 18, 2024, 8:26 a.m.
Size 62.0KB
Type PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
MD5 0bb47290ac45642ac44a00846eda74e2
SHA256 b6dcb01c7c91f76249539cfdd025d171ebbc37c2e19842b3f1d13122200de356
CRC32 D8C5FE59
ssdeep 1536:X2FpiG7JknoDR58tXwL6cgue6rsgE8PU6amwqvM5bGAgCPKOg1G8rnTRhx:X2FpiGNkgE8PU6aIvM5bGRMC/Lx
Yara
  • Malicious_Library_Zero - Malicious_Library
  • PE_Header_Zero - PE File Signature
  • Malicious_Packer_Zero - Malicious Packer
  • AsyncRat - AsyncRat Payload
  • Is_DotNET_EXE - (no description)
  • IsPE32 - (no description)
  • Win32_Trojan_PWS_Net_1_Zero - Win32 Trojan PWS .NET Azorult
  • UPX_Zero - UPX packed file
  • OS_Processor_Check_Zero - OS Processor Check

Name Response Post-Analysis Lookup
scar77747.duckdns.org
A 2.58.80.130
2.58.80.130
IP Address Status Action
164.124.101.2 Active Moloch
2.58.80.130 Active Moloch

Suricata Alerts

Flow SID Signature Category
UDP 192.168.56.103:52760 -> 164.124.101.2:53 2042936 ET INFO DYNAMIC_DNS Query to a *.duckdns .org Domain Potentially Bad Traffic
UDP 192.168.56.103:52760 -> 164.124.101.2:53 2022918 ET INFO DYNAMIC_DNS Query to *.duckdns. Domain Misc activity
TCP 2.58.80.130:6606 -> 192.168.56.103:49163 2030673 ET MALWARE Observed Malicious SSL Cert (AsyncRAT Server) Domain Observed Used for C2 Detected
TCP 2.58.80.130:6606 -> 192.168.56.103:49163 2035595 ET MALWARE Generic AsyncRAT Style SSL Cert Domain Observed Used for C2 Detected

Suricata TLS

Flow Issuer Subject Fingerprint
TLSv1
192.168.56.103:49163
2.58.80.130:6606 		CN=AsyncRAT Server CN=AsyncRAT Server c0:74:2f:cf:ac:08:26:95:4d:1f:b6:6f:1e:ab:22:b3:91:b1:75:90

domain scar77747.duckdns.org
Bkav W32.AIDetectMalware.CS
Lionic Trojan.Win32.AsyncRAT.m!c
Elastic Windows.Generic.Threat
MicroWorld-eScan Generic.AsyncRAT.Marte.B.6BB4019C
CAT-QuickHeal Backdoor.MsilFC.S14901152
Skyhigh BehavesLike.Win32.Fareit.km
ALYac Generic.AsyncRAT.Marte.B.6BB4019C
Cylance Unsafe
VIPRE Generic.AsyncRAT.Marte.B.6BB4019C
Sangfor Suspicious.Win32.Save.a
K7AntiVirus Riskware ( 00584baa1 )
BitDefender Generic.AsyncRAT.Marte.B.6BB4019C
K7GW Riskware ( 00584baa1 )
Cybereason malicious.0ac456
VirIT Trojan.Win32.MSIL_Heur.B
Symantec Downloader
ESET-NOD32 a variant of MSIL/AsyncRAT.A
APEX Malicious
McAfee PWS-FCQR!0BB47290AC45
Avast Win32:DropperX-gen [Drp]
Kaspersky HEUR:Backdoor.MSIL.Crysan.gen
Alibaba Backdoor:MSIL/AsyncRat.94f69248
NANO-Antivirus Trojan.Win32.Crysan.kpopyg
Rising Trojan.AntiVM!1.CF63 (CLASSIC)
Emsisoft Generic.AsyncRAT.Marte.B.6BB4019C (B)
F-Secure Trojan.TR/Dropper.Gen
DrWeb BackDoor.AsyncRATNET.2
TrendMicro TROJ_GEN.R014C0DGA24
McAfeeD ti!B6DCB01C7C91
FireEye Generic.mg.0bb47290ac45642a
Sophos Troj/AsyncRat-B
Ikarus Backdoor.AsyncRat
Webroot W32.Trojan.Gen
Google Detected
Avira TR/Dropper.Gen
MAX malware (ai score=89)
Kingsoft MSIL.Backdoor.Crysan.gen
Gridinsoft Trojan.Win32.Agent.sa
Arcabit Generic.AsyncRAT.Marte.B.6BB4019C
ZoneAlarm HEUR:Backdoor.MSIL.Crysan.gen
GData MSIL.Backdoor.DCRat.D
Varist W32/Samas.B.gen!Eldorado
AhnLab-V3 Malware/Win32.RL_Generic.C4267562
BitDefenderTheta Gen:NN.ZemsilF.36808.dm0@aGJB9Go
DeepInstinct MALICIOUS
VBA32 OScope.Backdoor.MSIL.Crysan
Malwarebytes Backdoor.AsyncRAT
Panda Trj/GdSda.A
TrendMicro-HouseCall TROJ_GEN.R014C0DGA24
Tencent Trojan.MSIL.Agent.kr