Resubmissions
22-02-2025 21:26
250222-1alw7aypfv 10
General
-
Target
1832-32-0x0000000000400000-0x0000000000432000-memory.dmp
-
Size
200KB
-
MD5
e816f0001eb467bc13143f3d2764e56b
-
SHA1
7b53fad1be25c370096731c744b66c21dedd4424
-
SHA256
6b23141545747608f70a5c86be432b65137a63349864336c03231bbe001dc5fc
-
SHA512
4bfdcc96470411d9ab4ba5b83de291319281df13e7376124b4e1a143c6a7a9b7d4561d20e47dd6fa03b6ccc261eb0ecae674272b5735ebf3bbdcde94a0cdd5db
-
SSDEEP
3072:Fe8p6ewdOIwQx76vK/bvTv0cU+lL/dMlZZUZ0b2gT6wARE+WpCc:J6ewwIwQJ6vKX0c5MlYZ0b2H
Score
10/10
Malware Config
Extracted
Family
asyncrat
Botnet
Default
C2
127.0.0.1:6606
127.0.0.1:7707
127.0.0.1:8808
https://api.telegram.org/bot7774608033:AAE1fvMZ0hM_UWWpPC6wvLbB9fKWjR8j4wA/sendMessage?chat_id=5224323271
Mutex
AsyncMutex_6SI8OkPnk
Attributes
-
delay
3
-
install
false
-
install_folder
%AppData%
aes.plain
Signatures
-
Asyncrat family
-
StormKitty payload 1 IoCs
-
Stormkitty family
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
Files
-
1832-32-0x0000000000400000-0x0000000000432000-memory.dmp
Headers
Sections