General
-
Target
OTP BULDER @ZerodayExploitware.exe
-
Size
175KB
-
MD5
0d421a91631c3c2cae6533bd32e2e595
-
SHA1
9113e54ec2b864a4845cb14930aa60666e1a596a
-
SHA256
e1df166da9ba07ad1a5b1a105eac585f04ea67a023cca16f54bdbfa97bb39dd2
-
SHA512
1d677726303cb667c01d8d340f5632667c1929dd5965e7008eab2d1755a02823cff1f583ece6987085ed1eb28429afa2592e5f0b6b63a3bb8e9c17d77c69d8ad
-
SSDEEP
3072:Ue8oX8Sb5KcXrtkkXmf/bDsvqtU+lLToChAP0UZ0b2gTIwAqE+Wpor:9Xtb5KcXr7XmfgqtjhAxZ0b2h
Score
10/10
Malware Config
Extracted
Family
asyncrat
Botnet
Default
C2
127.0.0.1:6606
127.0.0.1:7707
127.0.0.1:8808
https://api.telegram.org/bot6381067446:AAEZEWH8wbF7Q1Kou81_S0sE6VwJZGJKneM/sendMessage?chat_id=5901231421
Mutex
AsyncMutex_6SI8OkPnk
Attributes
-
delay
3
-
install
false
-
install_folder
%AppData%
aes.plain
Signatures
-
Async RAT payload 1 IoCs
-
Asyncrat family
-
StormKitty payload 1 IoCs
-
Stormkitty family
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
Files
-
OTP BULDER @ZerodayExploitware.exe
f34d5f2d4577ed6d9ceec516c1f5a744
Headers
Imports
Sections