Overview

overview

10

Static

static

10

2996-74-0x...ry.exe

windows7-x64

2996-74-0x...ry.exe

windows10-2004-x64

Sharing

Copy URL Twitter E-mail

General

  • Target

    2996-74-0x0000000000400000-0x0000000000418000-memory.dmp

  • Size

    96KB

  • MD5

    a10302c2c753881a2ecc754c6e4b47cb

  • SHA1

    4881a6e883451a61e5dd30b19453532a08d7d4aa

  • SHA256

    5c4161f919c5a202455b801b0859e3f54619d6fa2c00d7463d96ef7b5743410d

  • SHA512

    b4be89d5baa778e99057daa69a71d7de2a36712b94754fc299e6a364818e5e09c7fd8eead8381b8762ada05caef1975739856b7385f3b49c40b5b93cf6916d40

  • SSDEEP

    1536:jUUPcxVteCW7PMVee9VdQuDI6H1bf/gIYJHrAQzc:jUmcxV4x7PMVee9VdQsH1bfYIG0Q

Score
10/10
ratdefaultasyncrat

Malware Config

Extracted

Family

asyncrat

Version

Venom RAT + HVNC + Stealer + Grabber v6.0.1

Botnet

Default

C2

185.106.94.122:4449

Mutex

eodffjgmvop

Attributes
  • delay

    5

  • install

    false

  • install_folder

    %AppData%

aes.plain

Signatures

  • Async RAT payload 1 IoCs
    rat
  • Asyncrat family
    asyncrat
  • Unsigned PE 1 IoCs

    Checks for missing Authenticode signature.

Files

  • 2996-74-0x0000000000400000-0x0000000000418000-memory.dmp
    .exe windows x86


    Headers

    Sections