General
-
Target
Serverv1.exe
-
Size
175KB
-
MD5
86ec635a29a4c13bd3d32d34ec028efe
-
SHA1
c5ab23555b3921ae012aa945b9f1bb72dbd6fd59
-
SHA256
e25817f6fe634b116ec878c734495b848b68a56a12cb43181bc07d9da3be3835
-
SHA512
567e186c9f47bbf58114337e5bc2b696d2e65c93269b77cf60dc94f487b3c082196b30992d4992c2eee9dc9a59e7d0024d6bd2ae64e31e6515e699ff9f5065ea
-
SSDEEP
3072:2e8oX8Sb5KcXrtkkXmf/bDsvqtU+lLToChAP0UZ0b2gT1wAqE+Wpor:XXtb5KcXr7XmfgqtjhAxZ0b26
Malware Config
Extracted
asyncrat
Default
127.0.0.1:6606
127.0.0.1:7707
127.0.0.1:8808
https://api.telegram.org/bot6959532402:AAG6PUhEHO5sJn075QDj3pF3kOIEoYH6CpY/sendMessage?chat_id=6075361534
AsyncMutex_6SI8OkPnk
-
delay
3
-
install
false
-
install_folder
%AppData%
Signatures
-
Async RAT payload 1 IoCs
Processes:
resource yara_rule sample family_asyncrat -
Asyncrat family
-
StormKitty payload 1 IoCs
Processes:
resource yara_rule sample family_stormkitty -
Stormkitty family
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
Processes:
resource Serverv1.exe
Files
-
Serverv1.exe.exe windows:4 windows x86 arch:x86
f34d5f2d4577ed6d9ceec516c1f5a744
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
mscoree
_CorExeMain
Sections
.text Size: 172KB - Virtual size: 172KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ