asyncrat | 158162a2e1018f01bf256a2bd65882418c6b7e89 | Triage

Sharing

General

Target

158162a2e1018f01bf256a2bd65882418c6b7e89
Size

425KB
MD5

a023f65e2b275a6fa814b4247bd69c3b
SHA1

158162a2e1018f01bf256a2bd65882418c6b7e89
SHA256

ad784dcc210216c3cab22fa504436bab048c9555f0e79b1b51b599187c1b4e68
SHA512

00932a8a1439279973ec908010f75bf2cd9474e10e18c62866553039d384947d1097cb8b1081fffc8bf80a457fb298198ab0c64335d9dfe10fd6697b853c85b2
SSDEEP

3072:ghB5LrUwk4XVV0XjWdGbbWHCUnVHMpUzkatz:ghzLrUwk4XVqTWdkbyCUVsmQs

Score

10^/10

rat venom clients asyncrat

Malware Config

Extracted

Family

asyncrat

Version

5.0.5

Botnet

Venom Clients

C2

127.0.0.1:4449

Mutex

Venom_RAT_HVNC_Mutex_Venom RAT_HVNC

Attributes

delay
1
install
false
install_folder
%AppData%

aes.plain

Signatures

Async RAT payload 1 IoCs

resource	yara_rule
sample	asyncrat

Asyncrat family
asyncrat

Files

158162a2e1018f01bf256a2bd65882418c6b7e89
.exe windows x86

f34d5f2d4577ed6d9ceec516c1f5a744

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE

Imports

mscoree

_CorExeMain

Sections

.text
Size: 58KB - Virtual size: 58KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 365KB - Virtual size: 365KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ