General

  • Target

    9a8f8b44910d4c35a64244354966ce7bdd3bdff9189feee1d8e98b094c855138.zip

  • Size

    84KB

  • MD5

    0362d1111cb7d45af5f75d47caa8d6cb

  • SHA1

    78b5a4b964be344aff0b9c026afd4934826e1c8b

  • SHA256

    715c1fbf243cdd37c2e7f5cabe0093c366589ed477c4bb76348936fe26316579

  • SHA512

    2e01853c22f636f88d615afe9a861a0f7b405841995e2dda2db00facf5fe76dff3c4538964041b98ca6f40174400c1a3c26d2e43952c8632b798bb93d81292fd

  • SSDEEP

    1536:FEToUc4d9UKSXRKOdTPXvHupFEa4dU4pr9aNjKrGdAP953gLRmdRN8:e8Uc4nUKSXRR/uLWUUr9AGrbPz3gLO8

Score
10/10

Malware Config

Extracted

Family

asyncrat

Version

0.5.7B

Botnet

Default

C2

127.0.0.1:6606

127.0.0.1:7707

127.0.0.1:8808

127.0.0.1:1177

jntrojan.ddns.net:6606

jntrojan.ddns.net:7707

jntrojan.ddns.net:8808

jntrojan.ddns.net:1177

Mutex

AsyncMutex_6SI8OkPnk

Attributes
  • delay

    3

  • install

    true

  • install_file

    windows.exe

  • install_folder

    %Temp%

aes.plain

Signatures

  • Async RAT payload 1 IoCs
  • Asyncrat family

Files

  • 9a8f8b44910d4c35a64244354966ce7bdd3bdff9189feee1d8e98b094c855138.zip
    .zip

    Password: infected

  • 9a8f8b44910d4c35a64244354966ce7bdd3bdff9189feee1d8e98b094c855138.exe
    .exe windows x86

    Password: infected

    f34d5f2d4577ed6d9ceec516c1f5a744


    Headers

    Imports

    Sections