General
-
Target
ALL PC GAME HACK.exe
-
Size
170KB
-
Sample
231207-145ldshc6y
-
MD5
338b9b7d7bd920ad7f4037f6e5e28354
-
SHA1
954850a55b45734e081ba042a80091ef8a8a736b
-
SHA256
9f24c318ca0ba27a2bfb9294b126273817befcf53eff93bcef2024a554bb2775
-
SHA512
3973e61c65b1b5ae2460f69bd3e5c18167f6f9d96463f1cd60801f15a62a143ecdc5e572270af397e9070594d6552559259daf8d36f7fffeb49a13427280b013
-
SSDEEP
3072:r3ST4aYp5zZb2faAaVZUwq4LTTSiSNqIPuMi9bxJ2cmty+Wpx:baozZQ7aVOQTSFNXPji9bf
Malware Config
Extracted
asyncrat
Default
127.0.0.1:6606
127.0.0.1:7707
127.0.0.1:8808
https://api.telegram.org/bot6428436791:AAHUeqTcF4RyQiYJbx3HCWyLufD99p-06s0/sendMessage?chat_id=6119438547
AsyncMutex_6SI8OkPnk
-
delay
3
-
install
false
-
install_folder
%AppData%
Targets
-
-
Target
ALL PC GAME HACK.exe
-
Size
170KB
-
MD5
338b9b7d7bd920ad7f4037f6e5e28354
-
SHA1
954850a55b45734e081ba042a80091ef8a8a736b
-
SHA256
9f24c318ca0ba27a2bfb9294b126273817befcf53eff93bcef2024a554bb2775
-
SHA512
3973e61c65b1b5ae2460f69bd3e5c18167f6f9d96463f1cd60801f15a62a143ecdc5e572270af397e9070594d6552559259daf8d36f7fffeb49a13427280b013
-
SSDEEP
3072:r3ST4aYp5zZb2faAaVZUwq4LTTSiSNqIPuMi9bxJ2cmty+Wpx:baozZQ7aVOQTSFNXPji9bf
Score10/10-
AsyncRat
AsyncRAT is designed to remotely monitor and control other computers written in C#.
-
StormKitty
StormKitty is an open source info stealer written in C#.
-
StormKitty payload
-
Async RAT payload
-
Reads user/profile data of web browsers
Infostealers often target stored browser data, which can include saved credentials etc.
-
Drops desktop.ini file(s)
-
Looks up external IP address via web service
Uses a legitimate IP lookup service to find the infected system's external IP.
-
Looks up geolocation information via web service
Uses a legitimate geolocation service to find the infected system's geolocation info.
-