General
-
Target
2008-89-0x0000000000400000-0x0000000000440000-memory.dmp
-
Size
256KB
-
MD5
d9cc17dfb0b12d9b776e0f51a88cbde2
-
SHA1
109970ac2a8930b48da762237766a3eb4f201670
-
SHA256
6cac0ab812875cfdabeb6874d8a5b813ca2df97c959154215d7d5c336769708f
-
SHA512
5fe3c4544ebc1920ad9c2ccef89080b55ed6ed22145e771ea1e7d508e6d09e772a2b33a6eac28981eadeb82fdc851f80f61c4b14afc60409dd2997a9e8a3dd15
-
SSDEEP
6144:TDubaBBOBIIj6HLLYLCYJqvc1DxIt+Lb/xaHb7wI44xHcI:2baCIYLb8gILq
Score
10/10
Malware Config
Extracted
Family
asyncrat
Botnet
Default
C2
127.0.0.1:6606
127.0.0.1:7707
127.0.0.1:8808
https://api.telegram.org/bot5345460701:AAELDlYM_8yHwfKYHoYl_27JYXLpT-SLsyY/sendMessage?chat_id=689992339
Mutex
AsyncMutex_6SI8OkPnk
Attributes
-
delay
3
-
install
false
-
install_folder
%AppData%
aes.plain
Signatures
-
Async RAT payload 1 IoCs
-
Asyncrat family
-
StormKitty payload 1 IoCs
-
Stormkitty family
Files
-
2008-89-0x0000000000400000-0x0000000000440000-memory.dmp
Headers
Sections