General
-
Target
00005636c57566543b08e8f453c4e977f02b10b87803b6134365caddd5c09800
-
Size
73KB
-
MD5
5a978852670d651c4176fabd021d4e1f
-
SHA1
cbbc245b5b46c20c75e6082127b611985b8ac2a2
-
SHA256
00005636c57566543b08e8f453c4e977f02b10b87803b6134365caddd5c09800
-
SHA512
f648e2a35302575ac17c750c3ab014bfa0644a477fedda55d5f7af73de5437f8ba2b9721690ccfaa90f86d968c48d74b84cb88963629bdfb238fdc3545430b40
-
SSDEEP
1536:G8Z6cweHEyF8D87a+6+UFTY2+X4LQsnq+S4HqzVtSm1v:bZ6NwDC8++6+UJY2+qg5c4bH1v
Score
10/10
Malware Config
Extracted
Family
asyncrat
Botnet
Default
C2
127.0.0.1:6606
127.0.0.1:7707
127.0.0.1:8808
https://api.telegram.org/bot5019103854:AAHucpCsuoHfPSmzNdwO7ZF0KH52dPfSqqc/sendMessage?chat_id=775796924
Mutex
AsyncMutex_6SI8OkPnk
Attributes
-
delay
3
-
install
false
-
install_folder
%AppData%
aes.plain
Signatures
-
Async RAT payload 1 IoCs
-
Asyncrat family
-
StormKitty payload 1 IoCs
-
Stormkitty family
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
Files
-
00005636c57566543b08e8f453c4e977f02b10b87803b6134365caddd5c09800
-
gta vip mod menu.exe
f34d5f2d4577ed6d9ceec516c1f5a744
Headers
Imports
Sections