Overview

overview

10

Static

static

251b4cf0.exe

windows7_x64

10

251b4cf0.exe

windows10-2004_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    251b4cf0.exe

  • Size

    250KB

  • Sample

    220120-qqh55aabdr

  • MD5

    0c4d308254cea8285969f26023123a46

  • SHA1

    54ffda34ec3766b837d04b36987c01facf183098

  • SHA256

    b6f3db88b8c6070f8d31d9c36caa59ac7fbdf99b9eeb741ec3e25c73b23bc822

  • SHA512

    8bea7e137f9de38254bf0fe7dbb4d02e4ed1f9ad83be608d0441b8116108ea3a1aa8158aa37a45fdaa38ad9386cbfa50123238deb6afcb03f371df501c36a661

Score
10/10
asyncratsmokeloadervenom clientsbackdoorpersistenceratsuricatatrojan

Malware Config

Extracted

Family

smokeloader

Version

2020

C2

http://abpa.at/upload/

http://emaratghajari.com/upload/

http://d7qw.cn/upload/

http://alumik-group.ru/upload/

http://zamkikurgan.ru/upload/
rc4.i32
rc4.i32

Extracted

Family

asyncrat

Version

VenomRAT_HVNC 5.0.4

Botnet

Venom Clients

C2

127.0.0.1:4449

91.92.136.123:4449
Mutex

Venom_RAT_Mutex_Venom_RAT

Attributes
  • anti_vm

    false

  • bsod

    false

  • delay

    0

  • install

    false

  • install_folder

    %AppData%

  • pastebin_config

    null

aes.plain

Targets

    • Target

      251b4cf0.exe

    • Size

      250KB

    • MD5

      0c4d308254cea8285969f26023123a46

    • SHA1

      54ffda34ec3766b837d04b36987c01facf183098

    • SHA256

      b6f3db88b8c6070f8d31d9c36caa59ac7fbdf99b9eeb741ec3e25c73b23bc822

    • SHA512

      8bea7e137f9de38254bf0fe7dbb4d02e4ed1f9ad83be608d0441b8116108ea3a1aa8158aa37a45fdaa38ad9386cbfa50123238deb6afcb03f371df501c36a661

    Score
    10/10
    smokeloaderbackdoortrojanasyncratvenom clientspersistenceratsuricata

    • AsyncRat

      AsyncRAT is designed to remotely monitor and control other computers.

      ratasyncrat

    • SmokeLoader

      Modular backdoor trojan in use since 2014.

      trojanbackdoorsmokeloader

    • suricata: ET MALWARE Terse alphanumeric executable downloader high likelihood of being hostile

      suricata: ET MALWARE Terse alphanumeric executable downloader high likelihood of being hostile

      suricata

    • Async RAT payload

      rat

    • Downloads MZ/PE file

    • Executes dropped EXE

    • Sets service image path in registry

      persistence

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Deletes itself

    • Adds Run key to start application

      persistence

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

2
T1060

Privilege Escalation

Defense Evasion

Modify Registry

2
T1112

Credential Access

Discovery

Query Registry

2
T1012

System Information Discovery

3
T1082

Peripheral Device Discovery

1
T1120

Remote System Discovery

1
T1018

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks