Overview

overview

10

Static

static

10

NEAS.284d2...JC.exe

windows7-x64

10

NEAS.284d2...JC.exe

windows10-2004-x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target

    NEAS.284d20426126f6686a2f76f66f76f8b0_JC.exe

  • Size

    175KB

  • MD5

    284d20426126f6686a2f76f66f76f8b0

  • SHA1

    57e70c710de0d591a991ccc95de69dab9b9b53fb

  • SHA256

    e5fa102cb59c0018a4c1f2291e36a1caf65d853c84a0c83f4df4d6b972907c1d

  • SHA512

    5a930eae6a7638423cf771da2c92de4a9b758df520e003168ec05f0160035b768f10235e4cd41fd5b713ddab2d0c97016fdc738ef10496bff77b4480e133c183

  • SSDEEP

    3072:Ge8p6ewdOIwQx76vK/bvTv0cU+lL/dMlZZUZ0b2gTpwARE+WpCc:e6ewwIwQJ6vKX0c5MlYZ0b2G

Score
10/10
ratdefaultasyncratstormkitty

Malware Config

Extracted

Family

asyncrat

Botnet

Default

C2

127.0.0.1:6606

127.0.0.1:7707

127.0.0.1:8808

https://api.telegram.org/bot6463470054:AAEW35Bir6cdCSzHb6AZaoksuay5s3uZoa8/sendMessage?chat_id=977626625
Mutex

AsyncMutex_6SI8OkPnk

Attributes
  • delay

    3

  • install

    false

  • install_folder

    %AppData%

aes.plain

Signatures

  • Async RAT payload 1 IoCs
    rat
  • Asyncrat family
    asyncrat
  • StormKitty payload 1 IoCs
  • Stormkitty family
    stormkitty
  • Unsigned PE 1 IoCs

    Checks for missing Authenticode signature.

Files

  • NEAS.284d20426126f6686a2f76f66f76f8b0_JC.exe
    .exe windows:4 windows x86

    f34d5f2d4577ed6d9ceec516c1f5a744


    Headers

    Imports

    Sections