General
-
Target
da34ea26ddfedfd7966e8aedf0bb93e6.exe
-
Size
175KB
-
Sample
240628-jgc47axhld
-
MD5
da34ea26ddfedfd7966e8aedf0bb93e6
-
SHA1
ba30bde364d564268d175090364158cb66c165a9
-
SHA256
817940c9dd88c9d185f58532e2027e9df7bfaca8249ec96ae055da03c8750f20
-
SHA512
fbf634fd22ec37a65540c6ad1968b53666308d4d31a151c26b1444e242de40c95c0f48f96010bc72e5e0e9a10982b4f56590e96aded12015de915d7d86af8dff
-
SSDEEP
3072:oe8p6ewdOIwQx76vK/bvTv0cU+lL/dMlZZUZ0b2gT7wARE+WpCc:86ewwIwQJ6vKX0c5MlYZ0b2c
Behavioral task
behavioral1
Sample
da34ea26ddfedfd7966e8aedf0bb93e6.exe
Resource
win7-20240611-en
Behavioral task
behavioral2
Sample
da34ea26ddfedfd7966e8aedf0bb93e6.exe
Resource
win10v2004-20240508-en
Malware Config
Extracted
asyncrat
Default
127.0.0.1:6606
127.0.0.1:7707
127.0.0.1:8808
https://api.telegram.org/bot7379351260:AAGqtKlpHd72GFMRON17QY1OA6l1sR7mBik/sendMessage?chat_id=5795480469
AsyncMutex_6SI8OkPnk
-
delay
3
-
install
false
-
install_folder
%AppData%
Targets
-
-
Target
da34ea26ddfedfd7966e8aedf0bb93e6.exe
-
Size
175KB
-
MD5
da34ea26ddfedfd7966e8aedf0bb93e6
-
SHA1
ba30bde364d564268d175090364158cb66c165a9
-
SHA256
817940c9dd88c9d185f58532e2027e9df7bfaca8249ec96ae055da03c8750f20
-
SHA512
fbf634fd22ec37a65540c6ad1968b53666308d4d31a151c26b1444e242de40c95c0f48f96010bc72e5e0e9a10982b4f56590e96aded12015de915d7d86af8dff
-
SSDEEP
3072:oe8p6ewdOIwQx76vK/bvTv0cU+lL/dMlZZUZ0b2gT7wARE+WpCc:86ewwIwQJ6vKX0c5MlYZ0b2c
-
StormKitty payload
-
Drops desktop.ini file(s)
-
Looks up external IP address via web service
Uses a legitimate IP lookup service to find the infected system's external IP.
-
Looks up geolocation information via web service
Uses a legitimate geolocation service to find the infected system's geolocation info.
-