General
-
Target
68fad5f5f8de1c290df5d3754b4af358.exe
-
Size
175KB
-
MD5
68fad5f5f8de1c290df5d3754b4af358
-
SHA1
0028395243f38a03b13726915144b9848e8da39a
-
SHA256
dbacc134902ee72d1464d3b61a3518402b7ab54807bb7b7541fc2916c8119e9e
-
SHA512
ce44611d5c47fdcb979c715352f5050c816d4e5a814b102836856ede279f774e4709ca48fb95639ca66476ca547176370da7afc5185af066832732da2c80ee01
-
SSDEEP
3072:ge8p6ewdOIwQx76vK/bvTv0cU+lL/dMlZZUZ0b2gTWwARE+WpCc:06ewwIwQJ6vKX0c5MlYZ0b27
Score
10/10
Malware Config
Extracted
Family
asyncrat
Botnet
Default
C2
127.0.0.1:6606
127.0.0.1:7707
127.0.0.1:8808
https://api.telegram.org/bot6082381502:AAEEe5dVvSMdEf-_fKUh7iRqcNun3Q5DzxM/sendMessage?chat_id=5795480469
Mutex
AsyncMutex_6SI8OkPnk
Attributes
-
delay
3
-
install
false
-
install_folder
%AppData%
aes.plain
Signatures
-
Async RAT payload 1 IoCs
-
Asyncrat family
-
StormKitty payload 1 IoCs
-
Stormkitty family
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
Files
-
68fad5f5f8de1c290df5d3754b4af358.exe
f34d5f2d4577ed6d9ceec516c1f5a744
Headers
Imports
Sections