Report - ottwsttuw.exe

AsyncRAT backdoor PWS .NET framework Generic Malware PE File .NET EXE OS Processor Check PE32
ScreenShot
Created 2021.06.24 23:14 Machine s1_win7_x6401
Filename ottwsttuw.exe
Type PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
AI Score
9
Behavior Score
1.6
ZERO API file : clean
VT API (file) 32 detected (malicious, high confidence, Jigsaw, Unsafe, Save, ZemsilF, nu0@aemAPOg, Attribute, HighConfidence, Crysan, Generic ML PUA, Score, AGEN, Ursu, HeapOverride, ai score=84, Static AI, Malicious PE, susgen, confidence, 100%)
md5 5be8cfbec412b84cad8de61c090843c3
sha256 0d26a725dfe84f25ef37d6a667e37359638442d3ffba4b280850a39cc4d8cf14
ssdeep 6144:7PMK34rGiSi4kB3DBbZUdxG2hwdN4bgUvhLNGSMcE:7EKinSi53rUdxG2hwdN4bgUvhLNGSMcE
imphash f34d5f2d4577ed6d9ceec516c1f5a744
impfuzzy 3:rGsLdAIEK:tf
  Network IP location

Signature (3cnts)

Level Description
danger File has been identified by 32 AntiVirus engines on VirusTotal as malicious
notice The binary likely contains encrypted or compressed data indicative of a packer
info The executable contains unknown PE section names indicative of a packer (could be a false positive)

Rules (7cnts)

Level Name Description Collection
warning Generic_Malware_Zero Generic Malware binaries (upload)
watch Win32_Trojan_PWS_Net_1_Zero Win32 Trojan PWS .NET Azorult binaries (upload)
info Is_DotNET_EXE (no description) binaries (upload)
info IsPE32 (no description) binaries (upload)
info OS_Processor_Check_Zero OS Processor Check binaries (upload)
info PE_Header_Zero PE File Signature binaries (upload)
info Win_Backdoor_AsyncRAT_Zero Win Backdoor AsyncRAT binaries (upload)

Network (0cnts) ?

Request CC ASN Co IP4 Rule ? ZERO ?

Suricata ids

PE API

IAT(Import Address Table) Library

mscoree.dll
 0x43a000 _CorExeMain

EAT(Export Address Table) is none



Similarity measure (PE file only) - Checking for service failure