General
-
Target
97fe5fd73167841cc6a5db478b5278675a486cc46c25895e395c90e581aeeab6
-
Size
175KB
-
MD5
6f55f573d7be6673a30fb19acf36e000
-
SHA1
aab2c19cb382f2fefce7e1c49a6f3429657205e9
-
SHA256
97fe5fd73167841cc6a5db478b5278675a486cc46c25895e395c90e581aeeab6
-
SHA512
676a77d7b150665b693cb176d5f07266f0500af8eebc8c64ca4e39a2a0f073413e227c758c75fc3238cbbede19f74e4b69baad4f9c2658695a53be5f2663214a
-
SSDEEP
3072:ae8oX8Sb5KcXrtkkXmf/bDsvqtU+lLToChAP0UZ0b2gT5wAqE+Wpor:bXtb5KcXr7XmfgqtjhAxZ0b26
Score
10/10
Malware Config
Extracted
Family
asyncrat
Botnet
Default
C2
127.0.0.1:6606
127.0.0.1:7707
127.0.0.1:8808
https://api.telegram.org/bot7636279565:AAFfbV9wqzcTb1Fa4IkguermnQhZKwCqJSo/sendMessage?chat_id=7913121735
Mutex
AsyncMutex_6SI8OkPnk
Attributes
-
delay
3
-
install
false
-
install_folder
%AppData%
aes.plain
Signatures
-
Async RAT payload 1 IoCs
-
Asyncrat family
-
StormKitty payload 1 IoCs
-
Stormkitty family
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
Files
-
97fe5fd73167841cc6a5db478b5278675a486cc46c25895e395c90e581aeeab6
f34d5f2d4577ed6d9ceec516c1f5a744
Headers
Imports
Sections