Overview

overview

10

Static

static

10

NETFLIX CHECK.exe

windows10-1703-x64

10

NETFLIX CHECKER .exe

windows10-1703-x64

7

rdp_via_virusbug1.pyc

windows10-1703-x64

3

netflx pro...ls.exe

windows10-1703-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    NETFLIX CHECKER 2024.rar

  • Size

    10.8MB

  • MD5

    6d34ccae0ed9443277fc2d783fb52c32

  • SHA1

    289f2a71ebe366c8de16dfffe864d577b6d29224

  • SHA256

    3d629bec9197f53962123b063c1e77eec7f9a7360bd25aff32e3e36b8a49790d

  • SHA512

    9a5f46148e9e0f3c151d285a03b3013c64d6c5b26f4c81d0b609420e27b3aa7ac21a7b597b065a4df410a48747fb376dc4b7b5beaeb1083940d1c3d72af77854

  • SSDEEP

    196608:alfGIsbFwsf50CycjR/tyNmzxFHSm02c+oJsYvsatO0UoSUWjrHIVEvq:alOIO0qJumzrym02cYY0EEUWjHvq

Score
10/10
ratdefaultpyinstallerasyncratstormkitty

Malware Config

Extracted

Family

asyncrat

Botnet

Default

C2

127.0.0.1:6606

127.0.0.1:7707

127.0.0.1:8808

https://api.telegram.org/bot7296708750:AAHaReWmJb8V8RSaBq85rGeMNuKmZ4t2rS0/sendMessage?chat_id=7389740990
Mutex

AsyncMutex_6SI8OkPnk

Attributes
  • delay

    3

  • install

    false

  • install_folder

    %AppData%

aes.plain

Signatures

  • Async RAT payload 2 IoCs
    rat
  • Asyncrat family
    asyncrat
  • StormKitty payload 2 IoCs
  • Stormkitty family
    stormkitty
  • Detects Pyinstaller 1 IoCs
    pyinstaller
  • Unsigned PE 3 IoCs

    Checks for missing Authenticode signature.

Files

  • NETFLIX CHECKER 2024.rar
    .rar
  • NETFLIX CHECK.exe
    .exe windows:4 windows x86 arch:x86

    f34d5f2d4577ed6d9ceec516c1f5a744


    Headers

    Imports

    Sections

  • NETFLIX CHECKER .exe
    .exe windows:5 windows x64 arch:x64

    1af6c885af093afc55142c2f1761dbe8


    Headers

    Imports

    Sections

  • rdp_via_virusbug1.pyc
  • netflx proxy Tools.exe
    .exe windows:4 windows x86 arch:x86

    f34d5f2d4577ed6d9ceec516c1f5a744


    Headers

    Imports

    Sections