General
-
Target
066e566cfda5b91b45e6235c252695d1d796736cd21f61f44cd77787a338a84f
-
Size
175KB
-
MD5
ed17f5a962191fa6423599f58efc90c2
-
SHA1
a5186f3e3f96e58ea743408ba24d22df3f3cffee
-
SHA256
066e566cfda5b91b45e6235c252695d1d796736cd21f61f44cd77787a338a84f
-
SHA512
fb6036ea4c079af2c33749a3cc3619776bb344fe6166ff1b40397916486f87d4568f642988fc67a1f6e12d6735c9ed1c678d8f2961a2f41fffddb212f315f279
-
SSDEEP
3072:U+lBDp+LQ1/fU2RSIIj6hLLYLCYJqvc1DfDTwYhac4IauJX9bj72dm3pRQNQ+Wpv:FD8u/fdRSIIj6hLLYLCYJqvc1DfXwYhY
Score
10/10
Malware Config
Extracted
Family
asyncrat
Botnet
Default
C2
127.0.0.1:6606
127.0.0.1:7707
127.0.0.1:8808
https://api.telegram.org/bot8078461019:AAF9Ui92pCZToAXj8PXw9Sy8x9zcHtYpH2Y/sendMessage?chat_id=7964354947
Mutex
AsyncMutex_6SI8OkPnk
Attributes
-
delay
3
-
install
false
-
install_folder
%AppData%
aes.plain
1
VUUYlBJdkRNmBKSum23VKszrv5fUFkxC
Signatures
-
Async RAT payload 1 IoCs
-
Asyncrat family
-
StormKitty payload 1 IoCs
-
Stormkitty family
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
Files
-
066e566cfda5b91b45e6235c252695d1d796736cd21f61f44cd77787a338a84f
f34d5f2d4577ed6d9ceec516c1f5a744
Headers
Imports
Sections