Overview

overview

10

Static

static

10

4b78b38b09...b6.exe

windows7-x64

10

4b78b38b09...b6.exe

windows10-2004-x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target

    86daa0643993b2acb6cb92178f7b8723c9e11af63af7c1cf8cc38431b17583a7

  • Size

    28KB

  • MD5

    238971eb145e6d894867dcd79a559992

  • SHA1

    07458e02a57ef3b041a40ca4cc19c46718056f27

  • SHA256

    86daa0643993b2acb6cb92178f7b8723c9e11af63af7c1cf8cc38431b17583a7

  • SHA512

    5bf2eef9ba67f6f9499bc012da0202cf2bf5fd79581d4fa9838a2589cda53fa9092fc5dabf96c8944ec081d6b031b931449a4a5a02b897c0b103575be54fed48

  • SSDEEP

    768:WHsVJM/IROVKMXKQyssX3Zproo1XsF06YP7wyOEoPHF2:WMVy/cOUWgX3g68Ffo7wyOl2

Score
10/10
rat25 25 25 25asyncrat

Malware Config

Extracted

Family

asyncrat

Version

| CRACKED BY https://t.me/xworm_v2

Botnet

25 25 25 25

C2

wins26junspam.duckdns.org:9003

Mutex

AsyncMutex_6SIkaPnk

Attributes
  • delay

    3

  • install

    false

  • install_folder

    %AppData%

aes.plain

Signatures

  • Async RAT payload 1 IoCs
    rat
  • Asyncrat family
    asyncrat
  • Unsigned PE 1 IoCs

    Checks for missing Authenticode signature.

Files

  • 86daa0643993b2acb6cb92178f7b8723c9e11af63af7c1cf8cc38431b17583a7
    .zip

    Password: infected

  • 4b78b38b09059c2d958ce1e3a432265ad7e11fc23ac30f04200f996042aba2b6.exe
    .exe windows:4 windows x86 arch:x86

    f34d5f2d4577ed6d9ceec516c1f5a744


    Headers

    Imports

    Sections