General

  • Target

    23112023_1603_codernna.jpg

  • Size

    139KB

  • MD5

    efffba1927f6a92ca8fdfd5e2ba33440

  • SHA1

    0abcdc71a738365d74b25463f41f1bdb6b7fe6ef

  • SHA256

    ddf1c022c77790790f19379b260177048ea28f8dfacb0f5c8c8514fd699ab836

  • SHA512

    2494b115754b58615cfc11c9252968e96430cb960c2dd48acb9bee68c738450f98976b01c71311d1673d39ccb0c69e42983c79d7e9e76a102a9d11e1a37092d2

  • SSDEEP

    3072:M29tg/kwgE8vU6aGmKRfxbYwkn4IIXxHJ1GU0I8EUL5nTUzi:T9mswtKRZbewHajLa

Score
10/10

Malware Config

Extracted

Family

asyncrat

Version

AWS | 3Losh

Botnet

NNa

C2

buike.kozow.com:6606

buike.kozow.com:7707

buike.kozow.com:8808

Mutex

AsyncMut9348u95iuj3485u843u584iji34hr79duyh 9u324hiur934uiruu98

Attributes
  • delay

    3

  • install

    false

  • install_folder

    %AppData%

aes.plain

Signatures

  • Async RAT payload 1 IoCs
  • Asyncrat family
  • Detect ZGRat V1 1 IoCs
  • Zgrat family
  • Unsigned PE 1 IoCs

    Checks for missing Authenticode signature.

Files

  • 23112023_1603_codernna.jpg
    .exe windows:4 windows x86 arch:x86

    Password: infected

    f34d5f2d4577ed6d9ceec516c1f5a744


    Headers

    Imports

    Sections