General

  • Target

    23112023_1602_coderna.jpg

  • Size

    65KB

  • MD5

    cbb96929db676720addb90c67764d366

  • SHA1

    38e5458a902a87d4ad1e994d92a1dcdcd115c094

  • SHA256

    aa4bd04106c0aa7e985165538154e6b42923bd2662b00cd18776b97b7bd70342

  • SHA512

    8857e4a9cca6e58d3a390235a3090d2a09ee1a722bc375965ad7acef7cf39246fd2b75dcf63145a99813b3771c0aee93e5176b12949be69555029477798879d4

  • SSDEEP

    1536:M29tg/k4RWsUvaI9TRi/GW1jZERE8vU6aGmh0Rf8CbYvIQSGQYZzmbjf8riTRtx:M29tg/kwgE8vU6aGmKRfxbYwkn4IIXx

Score
10/10

Malware Config

Extracted

Family

asyncrat

Version

AWS | 3Losh

Botnet

NNa

C2

buike.kozow.com:6606

buike.kozow.com:7707

buike.kozow.com:8808

Mutex

AsyncMut9348u95iuj3485u843u584iji34hr79duyh 9u324hiur934uiruu98

Attributes
  • delay

    3

  • install

    false

  • install_folder

    %AppData%

aes.plain

Signatures

  • Async RAT payload 1 IoCs
  • Asyncrat family
  • Unsigned PE 1 IoCs

    Checks for missing Authenticode signature.

Files

  • 23112023_1602_coderna.jpg
    .exe windows:4 windows x86 arch:x86

    Password: infected

    f34d5f2d4577ed6d9ceec516c1f5a744


    Headers

    Imports

    Sections