General
-
Target
0x0009000000018b00-301.dat
-
Size
175KB
-
MD5
720b2d599314eaf90cd60038f7e7d2e8
-
SHA1
76592e0a64b599fbb49d006faa2de4211dd79834
-
SHA256
ea520d8e6ca1d44593f26ceea349d55709ebd61565f67368947d38e484f5846f
-
SHA512
eb5a2bc7cd470697cc3613edd51d3af9c4d64f05a71297a6b00c5137956bf269a62253fd60e7b994a750e3cc9eb44dae4275d10dd1356b4ea6140b16b2ab74e2
-
SSDEEP
3072:Ie8p6ewdOIwQx76vK/bvTv0cU+lL/dMlZZUZ0b2gThwARE+WpCc:c6ewwIwQJ6vKX0c5MlYZ0b2+
Score
10/10
Malware Config
Extracted
Family
asyncrat
Botnet
Default
C2
127.0.0.1:6606
127.0.0.1:7707
127.0.0.1:8808
https://api.telegram.org/bot6082381502:AAGYF_HaZVw7ziBPxYHyd8WNo0uQbAM7fiU/sendMessage?chat_id=5795480469
Mutex
AsyncMutex_6SI8OkPnk
Attributes
-
delay
3
-
install
false
-
install_folder
%AppData%
aes.plain
Signatures
-
Async RAT payload 1 IoCs
-
Asyncrat family
-
StormKitty payload 1 IoCs
-
Stormkitty family
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
Files
-
0x0009000000018b00-301.dat
f34d5f2d4577ed6d9ceec516c1f5a744
Headers
Imports
Sections