General
-
Target
2424-70-0x00000000013A0000-0x00000000023A0000-memory.dmp
-
Size
16.0MB
-
MD5
36789d7d1ece107863fd8d5ee156e7d8
-
SHA1
1eb4ef54b3c0db08aa0a94dd8f0c35607de02711
-
SHA256
00539777eaea8d03b63de19d9224a33094241f0dedc801d330d3ffcdc2ba0e2e
-
SHA512
0295eb8c81326afa685bd2283e0f3e24883078fedeb0aa875f3af933a1e4024586b6761137e1524b8f155942a9c8297fb4d691eb000bc59512eb56ffe39e439d
-
SSDEEP
3072:hpST7JS3xDUKuBg7JBZ3c3nMZPYOoJIvqIeu/i9bdJ2cewTob+WpK:cJ2dUKFJB5c0XeSi9b7
Score
10/10
Malware Config
Extracted
Family
asyncrat
Botnet
Default
C2
127.0.0.1:6606
127.0.0.1:7707
127.0.0.1:8808
https://api.telegram.org/bot6889241853:AAHAa8eUBd5h6tWRG0OvgDx7o1_LKQJi-y8/sendMessage?chat_id=6367688286
Mutex
AsyncMutex_6SI8OkPnk
Attributes
-
delay
3
-
install
false
-
install_folder
%AppData%
aes.plain
Signatures
-
Asyncrat family
-
StormKitty payload 1 IoCs
-
Stormkitty family
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
Files
-
2424-70-0x00000000013A0000-0x00000000023A0000-memory.dmp
Headers
Sections