Overview

overview

10

Static

static

10

Bitcoin-Ad...ig.exe

windows11-21h2-x64

10

Bitcoin-Ad...ty.exe

windows11-21h2-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    70cff7636e0aaaef0cf817cbdb6c1375706e711a.zip.tar.gz

  • Size

    12.9MB

  • MD5

    ac7dceb4a85cb4250ac1268f8a3d7481

  • SHA1

    fdc57ca604746204049368a5d23e6c2893590d42

  • SHA256

    38a22130997f3fd2afd7d0773735c729eca349ad93455866ad02543109f4329a

  • SHA512

    912cf8aaa594e0838d332fd5d67c1b212887adffcaf765911dda048e23c7e57d4531cb3395cf57f9be6e12c79402863c21af605dfabee854c0dd3e2e435533fd

  • SSDEEP

    196608:6Gy8SAdVkkiPx5yAPpl0AOIy/w4n2uMhrM0yEtWoGcUKJvbdS8VylZhBqhcDy:6Gy8LXBIRo6u6rM0LgkUKJzdSLnhkN

Score
10/10
ratdefaultupxasyncrat

Malware Config

Extracted

Family

asyncrat

Version

0.5.8

Botnet

Default

C2

192.168.101.7:6606

192.168.101.7:7707

192.168.101.7:8808

192.168.101.7:1111

192.168.101.7:2222

192.168.101.7:3333

192.168.101.7:4444

192.168.101.7:5555

192.168.101.7:6666

192.168.101.7:7777

192.168.101.7:8888

192.168.101.7:9999
Mutex

H6EV9c34IZEW

Attributes
  • delay

    3

  • install

    false

  • install_folder

    %AppData%

aes.plain

Signatures

  • Async RAT payload 1 IoCs
    rat
  • Asyncrat family
    asyncrat
  • UPX packed file 1 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  • Unsigned PE 4 IoCs

    Checks for missing Authenticode signature.

Files

  • 70cff7636e0aaaef0cf817cbdb6c1375706e711a.zip.tar.gz
    .zip

    Password: infected_te_report

  • 70cff7636e0aaaef0cf817cbdb6c1375706e711a.zip
    .zip

    Password: infected_te_report

  • Bitcoin-Address-Utility-main/Bitcoin-Address-Utility-main/README.md
  • Bitcoin-Address-Utility-main/Bitcoin-Address-Utility-main/bitcoin address utility/Bitcoin-note.png
    .png

    Password: infected_te_report

  • Bitcoin-Address-Utility-main/Bitcoin-Address-Utility-main/bitcoin address utility/BouncyCastle.Crypto.dll
    .dll windows:4 windows x86 arch:x86

    Password: infected_te_report

    dae02f32a21e03ce65412f6e56942daa


    Headers

    Imports

    Sections

  • Bitcoin-Address-Utility-main/Bitcoin-Address-Utility-main/bitcoin address utility/ThoughtWorks.QRCode.dll
    .dll windows:4 windows x86 arch:x86

    Password: infected_te_report

    dae02f32a21e03ce65412f6e56942daa


    Headers

    Imports

    Sections

  • Bitcoin-Address-Utility-main/Bitcoin-Address-Utility-main/bitcoin address utility/Ubuntu-R.ttf
  • Bitcoin-Address-Utility-main/Bitcoin-Address-Utility-main/bitcoin address utility/bitcoinaddresutility.config.exe
    .exe windows:4 windows x86 arch:x86

    Password: infected_te_report

    f34d5f2d4577ed6d9ceec516c1f5a744


    Headers

    Imports

    Sections

  • Bitcoin-Address-Utility-main/Bitcoin-Address-Utility-main/bitcoin address utility/note-Greyscale.png
    .png

    Password: infected_te_report

  • Bitcoin-Address-Utility-main/Bitcoin-Address-Utility-main/bitcoin address utility/note-blue.png
    .png

    Password: infected_te_report

  • Bitcoin-Address-Utility-main/Bitcoin-Address-Utility-main/bitcoin address utility/note-green.png
    .png

    Password: infected_te_report

  • Bitcoin-Address-Utility-main/Bitcoin-Address-Utility-main/bitcoin address utility/note-purple.png
    .png
  • Bitcoin-Address-Utility-main/Bitcoin-Address-Utility-main/bitcoin address utility/note-yellow.png
    .png
  • Bitcoin-Address-Utility-main/Bitcoin-Address-Utility-main/bitcoin address utility/setup-Btc Address Utility.exe
    .exe windows:4 windows x86 arch:x86


    Headers

    Sections

  • Bitcoin-Address-Utility-main/Bitcoin-Address-Utility-main/bitcoin address utility/source.zip
    .zip
  • Bitcoin-Address-Utility-main/README.md