Overview

overview

10

Static

static

10

2732-7-0x0...ry.exe

windows7-x64

2732-7-0x0...ry.exe

windows10-2004-x64

Resubmissions

13-01-2025 01:09

250113-bhwnxs1kgj 10

12-01-2025 12:45

250112-py158sspav 10

10-01-2025 15:54

250110-tcp83a1nhl 10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    2732-7-0x0000000000090000-0x00000000000C2000-memory.dmp

  • Size

    200KB

  • MD5

    0d58c90b931146ba8bd00c89d85d3efd

  • SHA1

    8de10f5639a70c8e851e4c882a079c750cbe60c9

  • SHA256

    5a3a8fc11723f0cb4a085c297a99cc40fd5f745d5eb1aa8a5d064eeacd541567

  • SHA512

    604ac1e34d76bdd2f8c928447447b1fbf2311e0cf80c352d1867c5c9b2498084d041a6ab40bd01092fb06edfc1f210f9d9cf982a5597201682328d6de5d3b972

  • SSDEEP

    3072:2e8p6ewdOIwQx76vK/bvTv0cU+lL/dMlZZUZ0b2gTVwARE+WpCk:u6ewwIwQJ6vKX0c5MlYZ0b2m

Score
10/10
defaultstormkittyasyncrat

Malware Config

Extracted

Family

asyncrat

Botnet

Default

C2

127.0.0.1:6606

127.0.0.1:7707

127.0.0.1:8808

https://api.telegram.org/bot7935009733:AAGBu91qWsmUHTs2GabvLt2Z62A3M4QqyqE/sendMessage?chat_id=6779103906
Mutex

AsyncMutex_6SI8OkPnk

Attributes
  • delay

    3

  • install

    false

  • install_folder

    %AppData%

aes.plain

Signatures

  • Asyncrat family
    asyncrat
  • StormKitty payload 1 IoCs
  • Stormkitty family
    stormkitty
  • Unsigned PE 1 IoCs

    Checks for missing Authenticode signature.

Files

  • 2732-7-0x0000000000090000-0x00000000000C2000-memory.dmp
    .exe windows:4 windows x86 arch:x86


    Headers

    Sections