asyncrat | Venom RAT + HVNC[.]exe | Triage

Sharing

General

Target

Venom RAT + HVNC.exe
Size

15.5MB
MD5

c9a19172aec8f4d35aabe33d2123d53c
SHA1

24f5dc16f84b7096d2561b628ee22e4aa3fb65a3
SHA256

51505fab78a7b318bcae9d3005fd3035517141abed16054541c29c03bb9af4ea
SHA512

cde593b070d0ea9067651fe107099621c3e1351ad00cf1c641b211fbb4adb380fb83d7a6276cff1e11496f43fc776c603f12ee67aacf0effaf192b4a53199994
SSDEEP

196608:IA5PPrnA5PPr3lAA5PPrJSe6PC7aIahLkNPFCZZwiJl1NLIsPA8fxvuIMzd/95Un:LebljNd60T7P+Zw6NLIsFfskh1BmXG

Score

10^/10

rat asyncrat

Malware Config

Signatures

Async RAT payload 1 IoCs

resource	yara_rule
sample	asyncrat

Asyncrat family
asyncrat

Files

Venom RAT + HVNC.exe
.exe windows x86

f34d5f2d4577ed6d9ceec516c1f5a744

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Imports

mscoree

_CorExeMain

Sections

.text
Size: 15.5MB - Virtual size: 15.5MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 9KB - Virtual size: 9KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ