Overview

overview

10

Static

static

10

6c0f0e572c...94.exe

windows7-x64

10

6c0f0e572c...94.exe

windows10-2004-x64

10

Resubmissions

13-01-2025 01:01

250113-bdb4qaxqdy 10

09-01-2025 19:03

250109-xqsg5azndp 10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    6c0f0e572cc778c48fd9f7e933ff9074b77228073245504f55170fb7f89bec94

  • Size

    233KB

  • MD5

    3ae4d230b70fe627b578cec30d650733

  • SHA1

    3ba4c86e93be24bb289d7936012547cc76e74b5d

  • SHA256

    6c0f0e572cc778c48fd9f7e933ff9074b77228073245504f55170fb7f89bec94

  • SHA512

    062adeba5c336d23799b4ff2a3cf99715dbc604a621047a99afb4e81b05f07bd96d0cd25690ba3ce9f69bd6310c8321f4e7b5fd1be4a6e77794c59d1c6352dc4

  • SSDEEP

    6144:oDubaBBOBIIj6HLLYLCYJqvc1DQw3k+jjLb/8Hbxbs5VnzHI:Bbarw3kMb0lb4V

Score
10/10
ratdefaultasyncratstormkitty

Malware Config

Extracted

Family

asyncrat

Botnet

Default

C2

127.0.0.1:6606

127.0.0.1:7707

127.0.0.1:8808

https://api.telegram.org/bot7510964527:AAGdCh-pkbTYHGH3dVQA167HKQ6_6_J6-Bg/sendMessage?chat_id=7551483138
Mutex

AsyncMutex_6SI8OkPnk

Attributes
  • delay

    3

  • install

    false

  • install_folder

    %AppData%

aes.plain

Signatures

  • Async RAT payload 1 IoCs
    rat
  • Asyncrat family
    asyncrat
  • StormKitty payload 1 IoCs
  • Stormkitty family
    stormkitty
  • Unsigned PE 1 IoCs

    Checks for missing Authenticode signature.

Files

  • 6c0f0e572cc778c48fd9f7e933ff9074b77228073245504f55170fb7f89bec94
    .exe windows:4 windows x86 arch:x86

    f34d5f2d4577ed6d9ceec516c1f5a744


    Headers

    Imports

    Sections