General

  • Target

    Rdp Cracking tool.zip

  • Size

    12.9MB

  • MD5

    9ed3a65009cb13d215fa1de6e4dbdb0d

  • SHA1

    6129d957e98a0d69e3a34871c811f7f63faa050b

  • SHA256

    68b32fe3170689eaca32c53ebddcc60f6ded63b25ff20cc550b7bdf716bc5c02

  • SHA512

    7fe97ffa1d9a0106091b3547a984e11f552d6b8874f4cff6e79373abe08264837bd6538f4629d95261845c49745c707a22aef41ceed23b4ea667178dbe95bec6

  • SSDEEP

    393216:w0RA7GG0bk/mG8VRRfa657IAsA9me7RzXtC:VxG0b8mGCny6tFsA/m

Malware Config

Extracted

Family

asyncrat

Botnet

Default

C2

127.0.0.1:6606

127.0.0.1:7707

127.0.0.1:8808

https://api.telegram.org/bot6006276473:AAEypRbqeWzZbeRTuV80WT3BeM7SOhM1n1E/sendMessage?chat_id=2045667165

Mutex

AsyncMutex_6SI8OkPnk

Attributes
  • delay

    3

  • install

    false

  • install_folder

    %AppData%

aes.plain

Signatures

  • Async RAT payload 2 IoCs
  • Asyncrat family
  • StormKitty payload 2 IoCs
  • Stormkitty family
  • Unsigned PE 7 IoCs

    Checks for missing Authenticode signature.

Files

  • Rdp Cracking tool.zip
    .zip
  • Rdp Cracking tool @ virusbug1/KPortScan 3.0 @virusbug1/KPortScan3 @virusbug1.exe
    .exe windows:5 windows x86 arch:x86

    532b8aac913da8c1aad5739aa4f295d6


    Headers

    Imports

    Sections

  • Rdp Cracking tool @ virusbug1/KPortScan 3.0 @virusbug1/Kport scan Activator.exe
    .exe windows:4 windows x86 arch:x86

    f34d5f2d4577ed6d9ceec516c1f5a744


    Headers

    Imports

    Sections

  • Rdp Cracking tool @ virusbug1/KPortScan 3.0 @virusbug1/QtCore4.dll
    .dll windows:5 windows x86 arch:x86

    e42fa5512b1ca9696bf0c91e7c10e9bf


    Headers

    Imports

    Exports

    Sections

  • Rdp Cracking tool @ virusbug1/KPortScan 3.0 @virusbug1/QtGui4.dll
    .dll windows:5 windows x86 arch:x86

    99890ca7fdc04ad490a89af49cef5a43


    Headers

    Imports

    Exports

    Sections

  • Rdp Cracking tool @ virusbug1/KPortScan 3.0 @virusbug1/QtNetwork4.dll
    .dll windows:5 windows x86 arch:x86

    46ff00918867dd3fd2afdd7a931edd0f


    Headers

    Imports

    Exports

    Sections

  • Rdp Cracking tool @ virusbug1/KPortScan 3.0 @virusbug1/results.txt
  • Rdp Cracking tool @ virusbug1/KPortScan 3.0 @virusbug1/results.txt.terabox.uploading.cfg
  • Rdp Cracking tool @ virusbug1/NL Brute @virusbug1/@virusbug1.jpg
    .jpg
  • Rdp Cracking tool @ virusbug1/NL Brute @virusbug1/NL Brute @virusbug1/@virusbug1.jpg
    .jpg
  • Rdp Cracking tool @ virusbug1/NL Brute @virusbug1/NL Brute @virusbug1/NL Brute 1.2 @virusbug1.exe
    .exe windows:6 windows x86 arch:x86


    Headers

    Exports

    Sections

  • Rdp Cracking tool @ virusbug1/NL Brute @virusbug1/NL Brute @virusbug1/NL Brute Activator.exe
    .exe windows:4 windows x86 arch:x86

    f34d5f2d4577ed6d9ceec516c1f5a744


    Headers

    Imports

    Sections

  • Rdp Cracking tool @ virusbug1/NL Brute @virusbug1/NL Brute @virusbug1/Read Me.txt
  • Rdp Cracking tool @ virusbug1/NL Brute @virusbug1/NL Brute @virusbug1/credentials.txt
  • Rdp Cracking tool @ virusbug1/NL Brute @virusbug1/NL Brute @virusbug1/good.txt
  • Rdp Cracking tool @ virusbug1/NL Brute @virusbug1/NL Brute @virusbug1/servers.txt
  • Rdp Cracking tool @ virusbug1/NL Brute @virusbug1/NL Brute @virusbug1/settings.ini
  • Rdp Cracking tool @ virusbug1/NL Brute @virusbug1/Simple Passwords List @virusbug1.txt
  • Rdp Cracking tool @ virusbug1/NL Brute @virusbug1/Simple Username List @virusbug1.txt