General
-
Target
55c51b45267d61bbd994f135ea87add0.bin
-
Size
107KB
-
MD5
588c7c441481d8fdff058651a858c3a8
-
SHA1
70871a5355c7b21850481ab78e62930f5df6917e
-
SHA256
675ba99aa81870f47c4d4c7f5c8223842573e4961e656f29d359ff14f7ad11ba
-
SHA512
fd85a8b6c6abf7044c11182ebf64d13cfd8922b6e7de5099af77180d1da441cf759a3ff097e68551471bea640aa116e83f726f6b009a7b927a35c0686c97b98c
-
SSDEEP
3072:NReiaIdex96k73yUFZK9Js+yPIEAktbqDyIT989:7NaIEX6k7CqR+yPIEx698
Score
10/10
Malware Config
Extracted
Family
asyncrat
Version
0.0.1
Botnet
Default
C2
127.0.0.1:6606
127.0.0.1:7707
127.0.0.1:8808
104.238.147.18:6606
104.238.147.18:7707
104.238.147.18:8808
https://api.telegram.org/bot6288147390:AAEaQec7zMvW6luY8UWV4rrPbj5q4jBpAvY/sendMessage?chat_id=2023484619
Mutex
AsyncMutex_6SI8OkPnk
Attributes
-
delay
3
-
install
false
-
install_folder
%AppData%
aes.plain
Signatures
-
Async RAT payload 1 IoCs
-
Asyncrat family
-
StormKitty payload 1 IoCs
-
Stormkitty family
Files
-
55c51b45267d61bbd994f135ea87add0.bin
Password: infected
-
e8e7259207aed56b83cd1b5ff9dd85fb31b03001e8044e41707d97730a5fe72a.exe
Password: infected
f34d5f2d4577ed6d9ceec516c1f5a744
Headers
Imports
Sections