Report - updateandr.txt

AsyncRAT backdoor

ScreenShot

Info
Location map


Created	2021.03.17 23:14	Machine	s1_win7_x3201
Filename	updateandr.txt
Type	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
AI Score	5	Behavior Score	2.0
ZERO API	file : malware
VT API (file)
md5	b91ce14fbeb12ab2233d195a4c71cd33
sha256	0e4915d612b1d930e773f70acc9f86c0263a86e5103d0ac52fc892db0a899e8c
ssdeep	768:nSrNa1MZ89fO8pn+CPYXW7tPJajWA6Z5JKZ3Ry/yFtlLT6DZ9QRJGfMFYVGflvxY:neNa1MZ89fO8JVPYmRQjB+kge7Tgj
imphash	f34d5f2d4577ed6d9ceec516c1f5a744
impfuzzy	3:rGsLdAIEK:tf

Network IP location

Signature (7cnts)

Level	Description
notice	Allocates read-write-execute memory (usually to unpack itself)
notice	Checks adapter addresses which can be used to detect virtual network interfaces
notice	Performs some HTTP requests
info	Checks amount of memory in system
info	Checks if process is being debugged by a debugger
info	Queries for the computername
info	Uses Windows APIs to generate a cryptographic key

Rules (6cnts)

Level	Name	Description	Collection
info	IsPE32	(no description)	binaries (upload)
info	PE_Header_Zero	PE File Signature Zero	binaries (upload)
info	HasOverlay	Overlay Check	binaries (upload)
info	IsNET_EXE	(no description)	binaries (upload)
info	IsWindowsGUI	(no description)	binaries (upload)
info	Win_Backdoor_AsyncRAT_Zero	Win Backdoor AsyncRAT	binaries (upload)

Network (8cnts) ?

Request	CC	ASN Co	IP4	Rule ?	ZERO ?
http://192.168.56.103:2869/upnphost/udhisapi.dll?content=uuid:d96d86f3-ac35-41f2-9523-f4e50073f2f3 whois			192.168.56.103		clean
http://liverpoolofcfanclub.com/liverpool-fc-news/features/steven-gerrard-liverpool-future-dalglish--goal-353AADFFA5A9D10A6A4795C11E4659D8.html whois		CLOUDFLARENET	104.21.31.39	361	mailcious
http://192.168.56.103:5357/da8ea474-550f-433d-b444-54d2081d1d24/ whois			192.168.56.103		clean
http://liverpoolofcfanclub.com/liverpool-fc-news/features/steven-gerrard-liverpool-future-dalglish--goal-94F0D464E713936751E4AD4ADA929BC3.html whois		CLOUDFLARENET	104.21.31.39	361	mailcious
http://liverpoolofcfanclub.com/liverpool-fc-news/features/steven-gerrard-liverpool-future-dalglish--goal-5C02B4706036B3BA6A7232CEC8A09625.html whois		CLOUDFLARENET	104.21.31.39	361	mailcious
http://192.168.56.103:2869/upnphost/udhisapi.dll?content=uuid:2d284ad3-5648-4376-8360-b0559e35418f whois			192.168.56.103		clean
liverpoolofcfanclub.com whois		CLOUDFLARENET	172.67.174.240		mailcious
172.67.174.240 whois		CLOUDFLARENET	172.67.174.240		clean

Suricata ids

PE API

IAT(Import Address Table) Library

mscoree.dll
0x402000 _CorExeMain

EAT(Export Address Table) is none

Similarity measure (PE file only) - Checking for service failure