asyncrat | d51be99781d3e1a89f9b632e748e2bd2fc1a1c554f8c1d9ac0db0a9e19af4c81

Sharing

Copy URL

Twitter E-mail

General

Target

d51be99781d3e1a89f9b632e748e2bd2fc1a1c554f8c1d9ac0db0a9e19af4c81
Size

234KB
MD5

4d54f37b7b9cb8f4e9a7ba334e711889
SHA1

d83e92210f74883074da45db0e50210ee0531fad
SHA256

d51be99781d3e1a89f9b632e748e2bd2fc1a1c554f8c1d9ac0db0a9e19af4c81
SHA512

effbb2b5c2bd3db1da9acbb8e8b298f69cd5de86fc2906c88c17e922290a0f7b9554075fbcd35a47b8a678ef573f097cc5656ac073823b9a1b387bc795c778d5
SSDEEP

3072:A+STW8djpN6izj8mZwpuAtiIR6iYj7PcUbBuVByshwp//DrB36eKzF0y6+WpRt:18XN6W8mmpmX0UbUeshIXDIzF4

Score

10^/10

rat default asyncrat stormkitty

Malware Config

Extracted

Family

asyncrat

Botnet

Default

127.0.0.1:6606

127.0.0.1:7707

127.0.0.1:8808

https://api.telegram.org/bot7478550442:AAFFrjVUKsvQtQXD68jNIEL-6LtQUIoajxw/sendMessage?chat_id=7253774309

Mutex

AsyncMutex_6SI8OkPnk

Attributes

delay
3
install
false
install_folder
%AppData%

aes.plain

Signatures

Async RAT payload 1 IoCs

rat

resource	yara_rule
sample	family_asyncrat

Asyncrat family
asyncrat

StormKitty payload 1 IoCs

resource	yara_rule
sample	family_stormkitty

Stormkitty family
stormkitty

Files

d51be99781d3e1a89f9b632e748e2bd2fc1a1c554f8c1d9ac0db0a9e19af4c81
.exe windows:4 windows x86 arch:x86

f34d5f2d4577ed6d9ceec516c1f5a744

Code Sign

33:00:00:01:df:6b:f0:2e:92:a7:4a:b4:d0:00:00:00:00:01:df
Certificate

Issuer

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

15/12/2020, 21:31

Not After

02/12/2021, 21:31

Subject

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:0e:90:d2:00:00:00:00:00:03
Certificate

Issuer

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

08/07/2011, 20:59

Not After

08/07/2026, 21:09

Subject

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

aa:08:72:80:a7:7a:e3:c6:64:99:3d:71:cb:79:e0:d6:b9:14:5e:a6:b4:12:37:2e:2f:2c:23:a7:82:47:20:f1
Signer

Actual PE Digest

aa:08:72:80:a7:7a:e3:c6:64:99:3d:71:cb:79:e0:d6:b9:14:5e:a6:b4:12:37:2e:2f:2c:23:a7:82:47:20:f1

Digest Algorithm

sha256

PE Digest Matches

false

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Imports

mscoree

_CorExeMain

Sections

.text
Size: 223KB - Virtual size: 223KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Extracted

Signatures

Files

f34d5f2d4577ed6d9ceec516c1f5a744

Code Sign

33:00:00:01:df:6b:f0:2e:92:a7:4a:b4:d0:00:00:00:00:01:dfCertificate

Extended Key Usages

61:0e:90:d2:00:00:00:00:00:03Certificate

Key Usages

aa:08:72:80:a7:7a:e3:c6:64:99:3d:71:cb:79:e0:d6:b9:14:5e:a6:b4:12:37:2e:2f:2c:23:a7:82:47:20:f1Signer

Headers

DLL Characteristics

File Characteristics

Imports

mscoree

Sections

.text Size: 223KB - Virtual size: 223KB

.rsrc Size: 1KB - Virtual size: 1KB

.reloc Size: 512B - Virtual size: 12B

33:00:00:01:df:6b:f0:2e:92:a7:4a:b4:d0:00:00:00:00:01:df
Certificate

61:0e:90:d2:00:00:00:00:00:03
Certificate

aa:08:72:80:a7:7a:e3:c6:64:99:3d:71:cb:79:e0:d6:b9:14:5e:a6:b4:12:37:2e:2f:2c:23:a7:82:47:20:f1
Signer

.text
Size: 223KB - Virtual size: 223KB

.rsrc
Size: 1KB - Virtual size: 1KB

.reloc
Size: 512B - Virtual size: 12B