General
-
Target
8e854ee90f0ca6891a512aaaa95cb54fdff6d26052fa0bb7acc4ef58469564ad
-
Size
175KB
-
MD5
e0788a76fc1eee6e158f1143788683c9
-
SHA1
41bb0bf272b0e6904425e9f6416a50addca28cc5
-
SHA256
8e854ee90f0ca6891a512aaaa95cb54fdff6d26052fa0bb7acc4ef58469564ad
-
SHA512
2bd6a2b937dcb479d5a79d7d6b0ec3344c164c8b2e502bc75996c8d153978dce45aae96748d4ee9c3ed99aac1c6e4f11b3c251acb06b12da6101697d618e084b
-
SSDEEP
3072:4e8p6ewdOIwQx76vK/bvTv0cU+lL/dMlZZUZ0b2gTbOwARE+WpCc:s6ewwIwQJ6vKX0c5MlYZ0b2om
Score
10/10
Malware Config
Extracted
Family
asyncrat
Botnet
Default
C2
127.0.0.1:6606
127.0.0.1:7707
127.0.0.1:8808
https://api.telegram.org/bot7475087682:AAEfJpWc86AxzuoY9HVEoL7CzhKKWWdwm7o/sendMessage?chat_id=8101604449
Mutex
AsyncMutex_6SI8OkPnk
Attributes
-
delay
3
-
install
false
-
install_folder
%AppData%
aes.plain
Signatures
-
Async RAT payload 1 IoCs
-
Asyncrat family
-
StormKitty payload 1 IoCs
-
Stormkitty family
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
Files
-
8e854ee90f0ca6891a512aaaa95cb54fdff6d26052fa0bb7acc4ef58469564ad
f34d5f2d4577ed6d9ceec516c1f5a744
Headers
Imports
Sections