General
-
Target
6c0f0e572cc778c48fd9f7e933ff9074b77228073245504f55170fb7f89bec94
-
Size
233KB
-
MD5
3ae4d230b70fe627b578cec30d650733
-
SHA1
3ba4c86e93be24bb289d7936012547cc76e74b5d
-
SHA256
6c0f0e572cc778c48fd9f7e933ff9074b77228073245504f55170fb7f89bec94
-
SHA512
062adeba5c336d23799b4ff2a3cf99715dbc604a621047a99afb4e81b05f07bd96d0cd25690ba3ce9f69bd6310c8321f4e7b5fd1be4a6e77794c59d1c6352dc4
-
SSDEEP
6144:oDubaBBOBIIj6HLLYLCYJqvc1DQw3k+jjLb/8Hbxbs5VnzHI:Bbarw3kMb0lb4V
Score
10/10
Malware Config
Extracted
Family
asyncrat
Botnet
Default
C2
127.0.0.1:6606
127.0.0.1:7707
127.0.0.1:8808
https://api.telegram.org/bot7510964527:AAGdCh-pkbTYHGH3dVQA167HKQ6_6_J6-Bg/sendMessage?chat_id=7551483138
Mutex
AsyncMutex_6SI8OkPnk
Attributes
-
delay
3
-
install
false
-
install_folder
%AppData%
aes.plain
Signatures
-
Async RAT payload 1 IoCs
-
Asyncrat family
-
StormKitty payload 1 IoCs
-
Stormkitty family
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
Files
-
6c0f0e572cc778c48fd9f7e933ff9074b77228073245504f55170fb7f89bec94
f34d5f2d4577ed6d9ceec516c1f5a744
Headers
Imports
Sections