Overview

overview

10

Static

static

10

flashETHv.1.exe

windows7-x64

10

flashETHv.1.exe

windows10-2004-x64

10

S444.exe

windows7-x64

10

S444.exe

windows10-2004-x64

10

SYS.exe

windows7-x64

10

SYS.exe

windows10-2004-x64

10

USDT Flasher.exe

windows7-x64

3

USDT Flasher.exe

windows10-2004-x64

3

ss32.exe

windows7-x64

10

ss32.exe

windows10-2004-x64

10

winlogoc.exe

windows7-x64

10

winlogoc.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    flashETHv.1.exe

  • Size

    701KB

  • MD5

    d57ac3c31d7069ee6a76c3572f5c234a

  • SHA1

    e6f3b23343a9b716c7529d282a2322c1f528b576

  • SHA256

    e73c96538ec60c2117b6ed82b7f95f8894abed022ee9ab03c1be90ebd9722f06

  • SHA512

    cb4334c76c427305b9b83f2d110e75827c4a83d296679aa04876ccbfd35c7787014a914b722348c076f5d2a3f306f98fdced54ad967953af4ad25d3f3c9eb529

  • SSDEEP

    12288:YwEWeJxd5eyh4R0a6mQlRkORS2DNIWWo0dK+/rYtlsfhZDFyJ/b9A64YVNSANzNc:YBfneyh4R0NPRFXBJWo0dK+/sjkhZZyM

Score
10/10
ratdefaultasyncratstormkittyxworm

Malware Config

Extracted

Family

asyncrat

Botnet

Default

C2

127.0.0.1:6606

127.0.0.1:7707

127.0.0.1:8808

https://api.telegram.org/bot7170788789:AAFDgtgiOhG8owpmypRYbNLRYrxlniuiyIs/sendMessage?chat_id=6101540297
Mutex

AsyncMutex_6SI8OkPnk

Attributes
  • delay

    3

  • install

    false

  • install_folder

    %AppData%

aes.plain

Extracted

Family

xworm

C2

SLL.casacam.net:4444

Attributes
  • Install_directory

    %LocalAppData%

  • install_file

    Interrupi.exe

Signatures

  • Async RAT payload 1 IoCs
    rat
  • Asyncrat family
    asyncrat
  • Detect Xworm Payload 1 IoCs
  • StormKitty payload 1 IoCs
  • Stormkitty family
    stormkitty
  • Xworm family
    xworm
  • Unsigned PE 6 IoCs

    Checks for missing Authenticode signature.

  • NSIS installer 2 IoCs
    installer

Files

  • flashETHv.1.exe
    .exe windows:4 windows x86 arch:x86

    29b61e5a552b3a9bc00953de1c93be41


    Headers

    Imports

    Sections

  • S444.exe
    .exe windows:4 windows x86 arch:x86

    f34d5f2d4577ed6d9ceec516c1f5a744


    Headers

    Imports

    Sections

  • SYS.exe
    .exe windows:4 windows x86 arch:x86

    f34d5f2d4577ed6d9ceec516c1f5a744


    Headers

    Imports

    Sections

  • USDT Flasher.exe
    .exe windows:4 windows x86 arch:x86

    f34d5f2d4577ed6d9ceec516c1f5a744


    Headers

    Imports

    Sections

  • ss32.exe
    .exe windows:4 windows x86 arch:x86

    f34d5f2d4577ed6d9ceec516c1f5a744


    Headers

    Imports

    Sections

  • winlogoc.exe
    .exe windows:4 windows x86 arch:x86

    f34d5f2d4577ed6d9ceec516c1f5a744


    Headers

    Imports

    Sections