General
-
Target
8a9ef72ff8aa0bb237ff77ca54cc6fa0afc722b31cb2cfc66c7ada09c0926cf5
-
Size
225KB
-
Sample
220925-q1ssbagahm
-
MD5
9a125cd0c0e665e9feea823376f725ab
-
SHA1
2f3108fb523f5a190dcd9a6e2581e7dee1b7931b
-
SHA256
8a9ef72ff8aa0bb237ff77ca54cc6fa0afc722b31cb2cfc66c7ada09c0926cf5
-
SHA512
fec6dc3723b933c362a092172bdc7d37a6f62213f392e7f074cd25cf638d269969260942e527a2f246d254de5be61f91a7af951236822d4d911f956b9350d051
-
SSDEEP
3072:O+STW8djpN6izj8mZwIvmU0EoscbB2v2pzyY4w/sApgl9vcQDyG6+WpO:z8XN6W8mmo1LoscbrpJ4wU4iv
Behavioral task
behavioral1
Sample
8a9ef72ff8aa0bb237ff77ca54cc6fa0afc722b31cb2cfc66c7ada09c0926cf5.exe
Resource
win7-20220812-en
Malware Config
Extracted
asyncrat
Default
127.0.0.1:6606
127.0.0.1:7707
127.0.0.1:8808
https://api.telegram.org/bot5345655805:AAF_ItNNJ0RGhGQQJT_0F7V0SVOpS9GL8TI/sendMessage?chat_id=813855013
AsyncMutex_6SI8OkPnk
-
delay
3
-
install
false
-
install_folder
%AppData%
Targets
-
-
Target
8a9ef72ff8aa0bb237ff77ca54cc6fa0afc722b31cb2cfc66c7ada09c0926cf5
-
Size
225KB
-
MD5
9a125cd0c0e665e9feea823376f725ab
-
SHA1
2f3108fb523f5a190dcd9a6e2581e7dee1b7931b
-
SHA256
8a9ef72ff8aa0bb237ff77ca54cc6fa0afc722b31cb2cfc66c7ada09c0926cf5
-
SHA512
fec6dc3723b933c362a092172bdc7d37a6f62213f392e7f074cd25cf638d269969260942e527a2f246d254de5be61f91a7af951236822d4d911f956b9350d051
-
SSDEEP
3072:O+STW8djpN6izj8mZwIvmU0EoscbB2v2pzyY4w/sApgl9vcQDyG6+WpO:z8XN6W8mmo1LoscbrpJ4wU4iv
-
StormKitty payload
-
Async RAT payload
-
Drops desktop.ini file(s)
-
Looks up external IP address via web service
Uses a legitimate IP lookup service to find the infected system's external IP.
-
Looks up geolocation information via web service
Uses a legitimate geolocation service to find the infected system's geolocation info.
-