General
-
Target
99d2c277b2dd65cd1dd8c954501043a2ec5891d339b7b8ddfad373841d9a9733
-
Size
170KB
-
MD5
efbe77e5aaf51ee1be7a02d2d55f6171
-
SHA1
5e88c3031a53715b82a66165d192551226c3de7f
-
SHA256
99d2c277b2dd65cd1dd8c954501043a2ec5891d339b7b8ddfad373841d9a9733
-
SHA512
8ba2f5c72e40249f73dc092054b118c9d3faf98978a5aac06662869ef4ed5f2b974759cf1bee2155d40e15bc647e2499c621a0915f6a79b07c640bff76e2d2db
-
SSDEEP
3072:O+STW8djpN6izj8mZwkYXvYUCEqIPu/i9bsJ2cjJI6+WpL:z8XN6W8mmBn5XPSi9boD
Score
10/10
Malware Config
Extracted
Family
asyncrat
Botnet
Default
C2
127.0.0.1:6606
127.0.0.1:7707
127.0.0.1:8808
https://api.telegram.org/bot7948363538:AAGPxAvOVmzz8x-5s0mHYlUprnmFgCHGEyo/sendMessage?chat_id=2115574643
Mutex
AsyncMutex_6SI8OkPnk
Attributes
-
delay
3
-
install
false
-
install_folder
%AppData%
aes.plain
Signatures
-
Async RAT payload 1 IoCs
-
Asyncrat family
-
StormKitty payload 1 IoCs
-
Stormkitty family
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
Files
-
99d2c277b2dd65cd1dd8c954501043a2ec5891d339b7b8ddfad373841d9a9733
f34d5f2d4577ed6d9ceec516c1f5a744
Headers
Imports
Sections