General

  • Target

    AnkaBotPC_4.0.5.rar

  • Size

    167.3MB

  • MD5

    a5dbe858dc9983fed2f8624e77b8a506

  • SHA1

    e36f0c2713e06f39daad111dde9cc5d13d170dc8

  • SHA256

    7ecfcfc4ea9e2c28f52836fb1122bf7327a77308b6bee25226967876d2ae889a

  • SHA512

    6f61549176d28c12dfc515d1cda77c1c7e58ae19ac116ca945be82626c043ee18999011d7b4e744fd480c3330e04a5c7c3ac20400dca250c923856275c638236

  • SSDEEP

    3145728:5azAZvwfcmwvQTRqjvNKOpLIseQ2OxETDSoO6q3WC5zmj1XaCwT4iG:5a6vwzrqNNereoO+mzMXavT+

Score
10/10

Malware Config

Extracted

Family

asyncrat

Version

Venom RAT + HVNC + Stealer + Grabber v6.0.0

Botnet

Default

C2

141.98.11.72:4449

Mutex

sdtgyxyhor

Attributes
  • delay

    1

  • install

    true

  • install_file

    Ankabotkey.exe

  • install_folder

    %AppData%

aes.plain

Signatures

  • Async RAT payload 1 IoCs
  • Asyncrat family

Files

  • AnkaBotPC_4.0.5.rar
    .rar

    Password: 888

  • AnkaBotPC_4.0.5/AnkaBotPC/AnkaBot.exe
    .exe windows x86

    Password: 888

    f34d5f2d4577ed6d9ceec516c1f5a744


    Headers

    Imports

    Sections

  • AnkaBotPC_4.0.5/AnkaBotPC/AnkaBotCrashHandler.exe
    .exe windows x86

    Password: 888

    f34d5f2d4577ed6d9ceec516c1f5a744


    Headers

    Imports

    Sections

  • AnkaBotPC_4.0.5/AnkaBotPC/AnkaBotProxy.exe
    .exe windows x86

    Password: 888

    229424187c42a7ec3a866b0c7b32872b


    Headers

    Imports

    Exports

    Sections

  • AnkaBotPC_4.0.5/AnkaBotPC/AnkaBotUpdater.exe
    .exe windows x86

    Password: 888

    f34d5f2d4577ed6d9ceec516c1f5a744


    Headers

    Imports

    Sections

  • AnkaBotPC_4.0.5/AnkaBotPC/Application/Application.exe
    .exe windows x86

    Password: 888

    55864f3591eaad330368af0792236d9f


    Headers

    Imports

    Exports

    Sections

  • AnkaBotPC_4.0.5/AnkaBotPC/Application/LICENSE
  • AnkaBotPC_4.0.5/AnkaBotPC/Application/LICENSES.chromium.html
  • AnkaBotPC_4.0.5/AnkaBotPC/Application/chrome_100_percent.pak
  • AnkaBotPC_4.0.5/AnkaBotPC/Application/chrome_200_percent.pak
  • AnkaBotPC_4.0.5/AnkaBotPC/Application/d3dcompiler_47.dll
    .dll windows x86

    Password: 888

    131726669bc1e34b495edb4198d0aca3


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • AnkaBotPC_4.0.5/AnkaBotPC/Application/ffmpeg.dll
    .dll windows x86

    Password: 888

    c7497313062f9c96c83518b36f70731f


    Headers

    Imports

    Exports

    Sections

  • AnkaBotPC_4.0.5/AnkaBotPC/Application/icudtl.dat
  • AnkaBotPC_4.0.5/AnkaBotPC/Application/libEGL.dll
    .dll windows x86

    Password: 888

    671e9b94c17af069171fc66ac98b577e


    Headers

    Imports

    Exports

    Sections

  • AnkaBotPC_4.0.5/AnkaBotPC/Application/libGLESv2.dll
    .dll windows x86

    97d924209513a8337442c2411e693b7b


    Headers

    Imports

    Exports

    Sections

  • AnkaBotPC_4.0.5/AnkaBotPC/Application/locales/am.pak
  • AnkaBotPC_4.0.5/AnkaBotPC/Application/locales/ar.pak
  • AnkaBotPC_4.0.5/AnkaBotPC/Application/locales/bg.pak
  • AnkaBotPC_4.0.5/AnkaBotPC/Application/locales/bn.pak
  • AnkaBotPC_4.0.5/AnkaBotPC/Application/locales/ca.pak
  • AnkaBotPC_4.0.5/AnkaBotPC/Application/locales/cs.pak
  • AnkaBotPC_4.0.5/AnkaBotPC/Application/locales/da.pak
  • AnkaBotPC_4.0.5/AnkaBotPC/Application/locales/de.pak
  • AnkaBotPC_4.0.5/AnkaBotPC/Application/locales/el.pak
  • AnkaBotPC_4.0.5/AnkaBotPC/Application/locales/en-GB.pak
  • AnkaBotPC_4.0.5/AnkaBotPC/Application/locales/en-US.pak
  • AnkaBotPC_4.0.5/AnkaBotPC/Application/locales/es-419.pak
  • AnkaBotPC_4.0.5/AnkaBotPC/Application/locales/es.pak
  • AnkaBotPC_4.0.5/AnkaBotPC/Application/locales/et.pak
  • AnkaBotPC_4.0.5/AnkaBotPC/Application/locales/fa.pak
  • AnkaBotPC_4.0.5/AnkaBotPC/Application/locales/fi.pak
  • AnkaBotPC_4.0.5/AnkaBotPC/Application/locales/fil.pak
  • AnkaBotPC_4.0.5/AnkaBotPC/Application/locales/fr.pak
  • AnkaBotPC_4.0.5/AnkaBotPC/Application/locales/gu.pak
  • AnkaBotPC_4.0.5/AnkaBotPC/Application/locales/he.pak
  • AnkaBotPC_4.0.5/AnkaBotPC/Application/locales/hi.pak
  • AnkaBotPC_4.0.5/AnkaBotPC/Application/locales/hr.pak
  • AnkaBotPC_4.0.5/AnkaBotPC/Application/locales/hu.pak
  • AnkaBotPC_4.0.5/AnkaBotPC/Application/locales/id.pak
  • AnkaBotPC_4.0.5/AnkaBotPC/Application/locales/it.pak
  • AnkaBotPC_4.0.5/AnkaBotPC/Application/locales/ja.pak
  • AnkaBotPC_4.0.5/AnkaBotPC/Application/locales/kn.pak
  • AnkaBotPC_4.0.5/AnkaBotPC/Application/locales/ko.pak
  • AnkaBotPC_4.0.5/AnkaBotPC/Application/locales/lt.pak
  • AnkaBotPC_4.0.5/AnkaBotPC/Application/locales/lv.pak
  • AnkaBotPC_4.0.5/AnkaBotPC/Application/locales/ml.pak
  • AnkaBotPC_4.0.5/AnkaBotPC/Application/locales/mr.pak
  • AnkaBotPC_4.0.5/AnkaBotPC/Application/locales/ms.pak
  • AnkaBotPC_4.0.5/AnkaBotPC/Application/locales/nb.pak
  • AnkaBotPC_4.0.5/AnkaBotPC/Application/locales/nl.pak
  • AnkaBotPC_4.0.5/AnkaBotPC/Application/locales/pl.pak
  • AnkaBotPC_4.0.5/AnkaBotPC/Application/locales/pt-BR.pak
  • AnkaBotPC_4.0.5/AnkaBotPC/Application/locales/pt-PT.pak
  • AnkaBotPC_4.0.5/AnkaBotPC/Application/locales/ro.pak
  • AnkaBotPC_4.0.5/AnkaBotPC/Application/locales/ru.pak
  • AnkaBotPC_4.0.5/AnkaBotPC/Application/locales/sk.pak
  • AnkaBotPC_4.0.5/AnkaBotPC/Application/locales/sl.pak
  • AnkaBotPC_4.0.5/AnkaBotPC/Application/locales/sr.pak
  • AnkaBotPC_4.0.5/AnkaBotPC/Application/locales/sv.pak
  • AnkaBotPC_4.0.5/AnkaBotPC/Application/locales/sw.pak
  • AnkaBotPC_4.0.5/AnkaBotPC/Application/locales/ta.pak
  • AnkaBotPC_4.0.5/AnkaBotPC/Application/locales/te.pak
  • AnkaBotPC_4.0.5/AnkaBotPC/Application/locales/th.pak
  • AnkaBotPC_4.0.5/AnkaBotPC/Application/locales/tr.pak
  • AnkaBotPC_4.0.5/AnkaBotPC/Application/locales/uk.pak
  • AnkaBotPC_4.0.5/AnkaBotPC/Application/locales/vi.pak
  • AnkaBotPC_4.0.5/AnkaBotPC/Application/locales/zh-CN.pak
  • AnkaBotPC_4.0.5/AnkaBotPC/Application/locales/zh-TW.pak
  • AnkaBotPC_4.0.5/AnkaBotPC/Application/resources.pak
  • AnkaBotPC_4.0.5/AnkaBotPC/Application/resources/app.asar
  • AnkaBotPC_4.0.5/AnkaBotPC/Application/snapshot_blob.bin
  • AnkaBotPC_4.0.5/AnkaBotPC/Application/swiftshader/libEGL.dll
    .dll windows x86

    7466b86b241e6faa3c539091b280b3a3


    Headers

    Imports

    Exports

    Sections

  • AnkaBotPC_4.0.5/AnkaBotPC/Application/swiftshader/libGLESv2.dll
    .dll windows x86

    b85270df2817667c40fde4ad43f6b7a8


    Headers

    Imports

    Exports

    Sections

  • AnkaBotPC_4.0.5/AnkaBotPC/Application/v8_context_snapshot.bin
  • AnkaBotPC_4.0.5/AnkaBotPC/Application/version
  • AnkaBotPC_4.0.5/AnkaBotPC/Application/vk_swiftshader.dll
    .dll windows x86

    98aa6edd9e515f46dd334da3d64e410d


    Headers

    Imports

    Exports

    Sections

  • AnkaBotPC_4.0.5/AnkaBotPC/Application/vk_swiftshader_icd.json
  • AnkaBotPC_4.0.5/AnkaBotPC/Application/vulkan-1.dll
    .dll windows x86

    187ddfd4d14cd16ab7fa0581cec00eea


    Headers

    Imports

    Exports

    Sections

  • AnkaBotPC_4.0.5/AnkaBotPC/Bypass.bat
    .exe windows x86

    f34d5f2d4577ed6d9ceec516c1f5a744


    Headers

    Imports

    Sections

  • AnkaBotPC_4.0.5/AnkaBotPC/MoonSharp.Interpreter.dll
    .dll windows x86

    dae02f32a21e03ce65412f6e56942daa


    Headers

    Imports

    Sections

  • AnkaBotPC_4.0.5/AnkaBotPC/Newtonsoft.Json.dll
    .dll windows x86

    dae02f32a21e03ce65412f6e56942daa


    Headers

    Imports

    Sections

  • AnkaBotPC_4.0.5/AnkaBotPC/No.Ankama.Injector.exe
    .exe windows x64

    34013a84ac8d58dfa8abb99a073deb1f


    Headers

    Imports

    Sections

  • AnkaBotPC_4.0.5/AnkaBotPC/No.Ankama_x64.dll
    .dll windows x64

    4a3e8725192f44f548f87f4101aaebc8


    Headers

    Imports

    Sections

  • AnkaBotPC_4.0.5/AnkaBotPC/No.Ankama_x86.dll
    .dll windows x86

    292a7a42b00e167efc774dc077b40857


    Headers

    Imports

    Sections

  • AnkaBotPC_4.0.5/AnkaBotPC/PushbulletSharp.dll
    .dll windows x86

    dae02f32a21e03ce65412f6e56942daa


    Headers

    Imports

    Sections

  • AnkaBotPC_4.0.5/AnkaBotPC/RTFLib.dll
    .dll windows x86

    dae02f32a21e03ce65412f6e56942daa


    Headers

    Imports

    Sections

  • AnkaBotPC_4.0.5/AnkaBotPC/SoundsAlert/ModeratorAlert.wav
  • AnkaBotPC_4.0.5/AnkaBotPC/Thrift45.dll
    .dll windows x86

    dae02f32a21e03ce65412f6e56942daa


    Code Sign

    Headers

    Imports

    Sections

  • AnkaBotPC_4.0.5/AnkaBotPC/libcrypto-1_1.dll
    .dll windows x86

    8c0767be991db4f5e9bd67fff379c857


    Headers

    Imports

    Exports

    Sections

  • AnkaBotPC_4.0.5/AnkaBotPC/rebex.net.proxysocket.dll
    .dll windows x86

    dae02f32a21e03ce65412f6e56942daa


    Headers

    Imports

    Sections

  • AnkaBotPC_4.0.5/AnkaBotPC/requirements/install_all.bat
  • AnkaBotPC_4.0.5/AnkaBotPC/requirements/vcredist2005_x64.exe
    .exe windows x86

    0ebb3c09b06b1666d307952e824c8697


    Code Sign

    Headers

    Imports

    Sections

  • AnkaBotPC_4.0.5/AnkaBotPC/requirements/vcredist2005_x86.exe
    .exe windows x86

    0ebb3c09b06b1666d307952e824c8697


    Code Sign

    Headers

    Imports

    Sections

  • AnkaBotPC_4.0.5/AnkaBotPC/requirements/vcredist2008_x64.exe
    .exe windows x86

    092eb6daba2f17cbda102fd1a32acd00


    Code Sign

    Headers

    Imports

    Sections

  • AnkaBotPC_4.0.5/AnkaBotPC/requirements/vcredist2008_x86.exe
    .exe windows x86

    092eb6daba2f17cbda102fd1a32acd00


    Code Sign

    Headers

    Imports

    Sections

  • AnkaBotPC_4.0.5/AnkaBotPC/requirements/vcredist2010_x64.exe
    .exe windows x86

    a1f6f100bff4507a3332f3f0cdfc24f5


    Code Sign

    Headers

    Imports

    Sections

  • AnkaBotPC_4.0.5/AnkaBotPC/requirements/vcredist2010_x86.exe
    .exe windows x86

    a1f6f100bff4507a3332f3f0cdfc24f5


    Code Sign

    Headers

    Imports

    Sections

  • AnkaBotPC_4.0.5/AnkaBotPC/requirements/vcredist2012_x64.exe
    .exe windows x86

    33c6db41ca15b47cfcec52de6c2ab2b7


    Code Sign

    Headers

    Imports

    Sections

  • AnkaBotPC_4.0.5/AnkaBotPC/requirements/vcredist2012_x86.exe
    .exe windows x86

    33c6db41ca15b47cfcec52de6c2ab2b7


    Code Sign

    Headers

    Imports

    Sections

  • AnkaBotPC_4.0.5/AnkaBotPC/requirements/vcredist2013_x64.exe
    .exe windows x86

    8e2588a9cf43886de3449dfff03137b6


    Code Sign

    Headers

    Imports

    Sections

  • AnkaBotPC_4.0.5/AnkaBotPC/requirements/vcredist2013_x86.exe
    .exe windows x86

    8e2588a9cf43886de3449dfff03137b6


    Code Sign

    Headers

    Imports

    Sections

  • AnkaBotPC_4.0.5/AnkaBotPC/requirements/vcredist2015_2017_2019_2022_x64.exe
    .exe windows x86

    1a5cdbf711fee14b077e599d13fddab2


    Code Sign

    Headers

    Imports

    Sections

  • AnkaBotPC_4.0.5/AnkaBotPC/requirements/vcredist2015_2017_2019_2022_x86.exe
    .exe windows x86

    1a5cdbf711fee14b077e599d13fddab2


    Code Sign

    Headers

    Imports

    Sections