We are hiring! Windows Kernel Developer (Remote), apply here!
flash

af5Cop6pCN.exe

Status: finished
Submission Time: 2022-09-23 08:13:09 +02:00
Malicious
Trojan
Evader
AsyncRAT, DcRat

Comments

Tags

  • AsyncRAT
  • exe
  • RAT

Details

  • Analysis ID:
    708255
  • API (Web) ID:
    1075713
  • Analysis Started:
    2022-09-23 08:14:53 +02:00
  • Analysis Finished:
    2022-09-23 08:24:33 +02:00
  • MD5:
    32a56b4e67436bdd3d39809a9be949b8
  • SHA1:
    dac60ca2763d18ce9451b28f4d0a1d9fbdc3f4fc
  • SHA256:
    5f6475a6d18503fbc2eb916e32ed1d6b4769f58d364ef2f94c2fd1a52c9aa1df
  • Technologies:
Full Report Management Report IOC Report Engine Info Verdict Score Reports

malicious

System: Windows 10 64 bit v1803 with Office Professional Plus 2016, Chrome 104, IE 11, Adobe Reader DC 19, Java 8 Update 211

malicious
100/100

malicious
16/35

malicious
24/26

malicious

IPs

IP Country Detection
3.72.110.63
United States
104.20.67.143
United States

Domains

Name IP Detection
termsiya.duckdns.org
3.72.110.63
pastebin.com
104.20.67.143
windowsupdatebg.s.llnwi.net
95.140.230.192

URLs

Name Detection
<!Cv
https://pastebin.com/raw/pffCggZp
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
Click to see the 3 hidden entries
http://pastebin.com
https://pastebin.com
https://pastebin.com8

Dropped files

Name File Type Hashes Detection
C:\Users\user\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\af5Cop6pCN.exe.log
ASCII text, with CRLF line terminators
#
C:\Users\user\AppData\Roaming\svchost.exe
PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
#
C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\77EC63BDA74BD0D0E0426DC8F8008506
Microsoft Cabinet archive data, 61745 bytes, 1 file
#
Click to see the 4 hidden entries
C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506
data
#
C:\Users\user\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\svchost.exe.log
ASCII text, with CRLF line terminators
#
C:\Users\user\AppData\Local\Temp\tmp5ECD.tmp.bat
DOS batch file, ASCII text, with CRLF line terminators
#
\Device\Null
ASCII text, with CRLF line terminators, with overstriking
#