Report - china.png

AsyncRAT backdoor
ScreenShot
Created 2021.04.06 17:13 Machine s1_win7_x6402
Filename china.png
Type PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
AI Score
6
Behavior Score
7.2
ZERO API file : malware
VT API (file) 49 detected (Bulz, Unsafe, Save, TrojanPSW, Racealer, malicious, MEWZ, Attribute, HighConfidence, DropperX, Malware@#3tzfnsb5jcfa5, Siggen12, Tiny, zjrdy, PSWTroj, kcloud, Ymacco, score, ZemsilF, am0@aaeyfup, ai score=99, R002H0CCV21, CLOUD, Static AI, Malicious PE, susgen, GdSda, confidence, 100%, Raccoon, HgIASR0A)
md5 6be41709f8bfbf06307cc56d04249801
sha256 0099e62ea3beb0f1631eb088bd697fd829963713ef4cb0e3a0a72b8c950c2383
ssdeep 192:3rFqRMky3fM9V7FKI47Wd+h4+0XoQ9DWhL3mj9:3rFqRMh3KlFP47Wd+hr059UL3m
imphash f34d5f2d4577ed6d9ceec516c1f5a744
impfuzzy 3:rGsLdAIEK:tf
  Network IP location

Signature (16cnts)

Level Description
danger File has been identified by 49 AntiVirus engines on VirusTotal as malicious
warning Generates some ICMP traffic
watch Communicates with host for which no DNS query was performed
watch Installs itself for autorun at Windows startup
notice Allocates read-write-execute memory (usually to unpack itself)
notice Checks adapter addresses which can be used to detect virtual network interfaces
notice Creates executable files on the filesystem
notice Drops a binary and executes it
notice Drops an executable to the user AppData folder
notice HTTP traffic contains suspicious features which may be indicative of malware related traffic
notice One or more potentially interesting buffers were extracted
notice Performs some HTTP requests
info Checks amount of memory in system
info Checks if process is being debugged by a debugger
info Collects information to fingerprint the system (MachineGuid
info This executable has a PDB path

Rules (13cnts)

Level Name Description Collection
info IsPE32 (no description) binaries (download)
info IsPE32 (no description) binaries (upload)
info OS_Processor_Check_Zero OS Processor Check Signature Zero binaries (download)
info PE_Header_Zero PE File Signature Zero binaries (download)
info PE_Header_Zero PE File Signature Zero binaries (upload)
info HasDebugData DebugData Check binaries (upload)
info IsNET_EXE (no description) binaries (upload)
info IsPacked Entropy Check binaries (download)
info IsWindowsGUI (no description) binaries (download)
info IsWindowsGUI (no description) binaries (upload)
info Win_Backdoor_AsyncRAT_Zero Win Backdoor AsyncRAT binaries (upload)
info win_files_operation Affect private profile binaries (download)
info win_registry Affect system registries binaries (download)

Network (18cnts) ?

Request CC ASN Co IP4 Rule ? ZERO ?
https://cdn.discordapp.com/attachments/826416818390040589/826531006563352596/Bussed_2021-03-30_21-01.exe Unknown 162.159.129.233 malware
https://cdn.discordapp.com/attachments/826416818390040589/826540039764705360/7525b875713675d4ff0018cf084f493a4e4977de_2021-03-30_22-25.exe Unknown 162.159.129.233 malware
https://cdn.discordapp.com/attachments/826416818390040589/826469949593485312/file.exe Unknown 162.159.129.233 malware
https://cdn.discordapp.com/attachments/826198252025675816/826538114838298715/install_setupVPSfree.exe Unknown 162.159.130.233 malware
https://gwenetha.info/setup-KGQJ-1.exe US CLOUDFLARENET 104.21.12.27 malware
https://iplogger.org/2LehR6.exe DE Hetzner Online GmbH 88.99.66.31 mailcious
https://cdn.discordapp.com/attachments/826416818390040589/826855866228670474/7525b875715555.exe Unknown 162.159.129.233 malware
https://pastebin.com/raw/gCyjHCCH US CLOUDFLARENET 104.23.98.190 mailcious
gwenetha.info US CLOUDFLARENET 172.67.131.232 malware
iplogger.org DE Hetzner Online GmbH 88.99.66.31 mailcious
whatitis.website Unknown mailcious
pastebin.com US CLOUDFLARENET 104.23.99.190 mailcious
cdn.discordapp.com Unknown 162.159.129.233 malware
104.21.12.27 US CLOUDFLARENET 104.21.12.27 malware
162.159.129.233 Unknown 162.159.129.233 malware
162.159.130.233 Unknown 162.159.130.233 malware
88.99.66.31 DE Hetzner Online GmbH 88.99.66.31 mailcious
104.23.98.190 US CLOUDFLARENET 104.23.98.190 mailcious

Suricata ids

PE API

IAT(Import Address Table) Library

mscoree.dll
 0x402000 _CorExeMain

EAT(Export Address Table) is none



Similarity measure (PE file only) - Checking for service failure