General
-
Target
0x000d000000008ad1-69.dat
-
Size
226KB
-
MD5
e9be9ca140f0fe7c6e8c9246b43e92f0
-
SHA1
6cab0776ff503c42e02850b31f12746f4736b1a0
-
SHA256
ddf0e4ffcdcf120d591a1ea82e58f21936d763f90dc3b33a4c4750fd1496652a
-
SHA512
a377f999ff181510a6798b52506b283b6f5d0406a393cda3815d83ddec8a39c48ec8b110f6bba72062bef03af35fe2ab8eca6268421ecb812037703bb493c43d
-
SSDEEP
3072:q+STW8djpN6izj8mZw8yr8IUbBUGF45VkHzyP9C1rlJHJtEUM6+WpZ:X8XN6W8mmrUbaGKPkHW41XJKU
Score
10/10
Malware Config
Extracted
Family
asyncrat
Botnet
Default
C2
127.0.0.1:6606
127.0.0.1:7707
127.0.0.1:8808
https://api.telegram.org/bot5418167780:AAG6XcSYhQ7qknQ8Cj1YipvMX213kbiDV7s/sendMessage?chat_id=5268900600
Mutex
AsyncMutex_6SI8OkPnk
Attributes
-
delay
3
-
install
false
-
install_folder
%AppData%
aes.plain
Signatures
-
Async RAT payload 1 IoCs
-
Asyncrat family
-
StormKitty payload 1 IoCs
-
Stormkitty family
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
Files
-
0x000d000000008ad1-69.dat
f34d5f2d4577ed6d9ceec516c1f5a744
Headers
Imports
Sections