General
-
Target
1940-10-0x0000000000400000-0x0000000000430000-memory.dmp
-
Size
192KB
-
MD5
0d082ef7cf10ce8e1628e47665b455ad
-
SHA1
33486b95825a7ecdc6b6ccdd6ae2c7ae4361ff68
-
SHA256
33ebd72eaa43ee7cc1a44e94e2a431312f9b5c4723cbd2385e3f142b036f4566
-
SHA512
86482558e8de1c05216a15d8c36720753d654dac9e714ac54327be526405f8956683852129814d41e4b6edf20015379f52bddfeb441da052bd4cb3e4991ed4f6
-
SSDEEP
3072:epST7JS3xDUKuBg7JBZ3FZdJ7tp/qIeu/+9bMJ2c+09Th0s+R8b+Wpl:NJ2dUKFJB57fXeS+9bIUm0PR
Score
10/10
Malware Config
Extracted
Family
asyncrat
Botnet
Default
C2
127.0.0.1:6606
127.0.0.1:7707
127.0.0.1:8808
https://api.telegram.org/bot6385771902:AAFzEpqHXketXwfW52woBHFnqZy6kfI91A0/sendMessage?chat_id=6517488336
Mutex
AsyncMutex_6SI8OkPnk
Attributes
-
delay
3
-
install
false
-
install_folder
%AppData%
aes.plain
Signatures
-
Asyncrat family
-
StormKitty payload 1 IoCs
-
Stormkitty family
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
Files
-
1940-10-0x0000000000400000-0x0000000000430000-memory.dmp
Headers
Sections