C:\Users\C5\source\repos\Ring3 Rootkit Remover\x64\Release\Ring3 Rootkit Remover.pdb
General
-
Target
Loli-Mod-main.zip
-
Size
3.8MB
-
MD5
79993a6a093e42d5428960b6c848562b
-
SHA1
bc2f0a472b573f353634253c4f27f5de07801671
-
SHA256
fb63758b69032986e72f3d9a3e95b651151dce8f4349aa539b65422beef5702a
-
SHA512
3d60502c7ef2d2511f963b7b71ef1bca3b7fad8663214087e69f66b295e75ce7f9c54e587abcee90409a369e36ab79784c20b833cef464ef7a1f955a1c3b5d6c
-
SSDEEP
98304:gydFzGWjLrlEJMiufgWwT2dH1UgbjFKpEc2GfwUzd6FG:gqhuJMimgWwT2dVUgbZ8lnfEg
Score
10/10
Malware Config
Extracted
Family
asyncrat
Version
AsyncRAT
Botnet
Default
C2
yyyson22.gleeze.com:4608
Mutex
dw
Attributes
-
delay
3
-
install
false
-
install_folder
%AppData%
aes.plain
Extracted
Family
xworm
Version
5.0
Mutex
GQrSWs3TiKJsppyp
Attributes
-
Install_directory
%AppData%
-
install_file
COM Surogate.exe
-
pastebin_url
https://pastebin.com/raw/EJ2UmS6u
aes.plain
Signatures
-
Async RAT payload 1 IoCs
-
Asyncrat family
-
Detect Xworm Payload 1 IoCs
-
Xworm family
-
Unsigned PE 4 IoCs
Checks for missing Authenticode signature.
Files
-
Loli-Mod-main.zip
-
Loli-Mod-main/AsyncClient.exe
f34d5f2d4577ed6d9ceec516c1f5a744
Headers
Imports
Sections
-
Loli-Mod-main/Loli Injector.bat
-
Loli-Mod-main/README.md
-
Loli-Mod-main/Stage 1.exe
2ebdf61403ea2409124c671b6dd0f594
Headers
Imports
Sections
-
Loli-Mod-main/hvnc.exe
f34d5f2d4577ed6d9ceec516c1f5a744
Headers
Imports
Sections
-
Loli-Mod-main/y.exe
f34d5f2d4577ed6d9ceec516c1f5a744
Headers
Imports
Sections