Overview

overview

10

Static

static

vbc.exe

windows7_x64

10

vbc.exe

windows10-2004_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    vbc.exelzzisrbl

  • Size

    455KB

  • Sample

    220512-t9ztrsgbbq

  • MD5

    f383aca77ec8694ab609f6c6ee464bde

  • SHA1

    836abb931164edf8ea1ec1437b94eed0fc568049

  • SHA256

    6c13935ce459215baf7b863cf206747125cacca60793e81ca06ee66139eeba79

  • SHA512

    7acba871babb6cba09d1e444387d4d282f65b951b16127145521cd70915995425de6efc72a5f6400c81371734e5a47eaa33ed76ce06586f45fc8df1108af4040

Score
10/10
asyncratvenom clientsrat

Malware Config

Extracted

Family

asyncrat

Version

5.0.5

Botnet

Venom Clients

C2

194.5.97.88:5050

Mutex

Venom_RAT_HVNC_Mutex_Venom RAT_HVNC

Attributes
  • delay

    1

  • install

    false

  • install_folder

    %AppData%

aes.plain

Targets

    • Target

      vbc.exelzzisrbl

    • Size

      455KB

    • MD5

      f383aca77ec8694ab609f6c6ee464bde

    • SHA1

      836abb931164edf8ea1ec1437b94eed0fc568049

    • SHA256

      6c13935ce459215baf7b863cf206747125cacca60793e81ca06ee66139eeba79

    • SHA512

      7acba871babb6cba09d1e444387d4d282f65b951b16127145521cd70915995425de6efc72a5f6400c81371734e5a47eaa33ed76ce06586f45fc8df1108af4040

    Score
    10/10
    asyncratvenom clientsrat

    • AsyncRat

      AsyncRAT is designed to remotely monitor and control other computers.

      ratasyncrat

    • Async RAT payload

      rat

    • Executes dropped EXE

    • Loads dropped DLL

    • Uses the VBS compiler for execution

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks