Overview

overview

10

Static

static

10

Venom5-HVNC-Rat.zip

windows10-2004-x64

1

System.Xml.XPath.dll

windows10-2004-x64

1

System.Xml...nt.dll

windows10-2004-x64

1

System.Xml...er.dll

windows10-2004-x64

1

VenomRAT_HVNC.exe

windows10-2004-x64

10

VenomRAT_HVNC.exe.xml

windows10-2004-x64

1

VenomRAT_HVNC.pdb

windows10-2004-x64

3

Vestris.Re...ib.dll

windows10-2004-x64

1

Vestris.Re...ib.xml

windows10-2004-x64

1

bhatrussia.url

windows10-2004-x64

3

blackhatrussia.url

windows10-2004-x64

3

cGeoIp.dll

windows10-2004-x64

1

client.exe

windows10-2004-x64

10

dnlib.dll

windows10-2004-x64

1

gbpast - Login.url

windows10-2004-x64

1

learn all ...ng.url

windows10-2004-x64

1

netstandard.dll

windows10-2004-x64

1

packages/V...re.p7s

windows10-2004-x64

7

packages/V....nupkg

windows10-2004-x64

3

packages/V...ib.dll

windows10-2004-x64

1

packages/V...ib.xml

windows10-2004-x64

1

packages/V...ib.dll

windows10-2004-x64

1

packages/V...ib.xml

windows10-2004-x64

1

packages/V...ib.dll

windows10-2004-x64

1

packages/V...ib.xml

windows10-2004-x64

1

packages/V...ib.dll

windows10-2004-x64

1

packages/V...ib.xml

windows10-2004-x64

1

packages/V...ib.dll

windows10-2004-x64

1

packages/V...ib.xml

windows10-2004-x64

1

protobuf-net.dll

windows10-2004-x64

1

readme.txt

windows10-2004-x64

1

svchost.exe

windows10-2004-x64

7

Sharing

Copy URL
Twitter E-mail

General

  • Target

    Venom5-HVNC-Rat.zip

  • Size

    16.1MB

  • Sample

    231106-xbs54sda3s

  • MD5

    3a333133b553ea299cab6aea4245e8ea

  • SHA1

    cfa201b7ceee02db2d4cfccb1903b625938b4b5f

  • SHA256

    3dfe4a942287b47f1eb29225788c1b0fc69eb1c1d5acbabd4c10788a2b7d3e52

  • SHA512

    ad582c6f854712bb0b0f703cbb2ca6651b919259eb169bf3892aa32a7f072b5b919fc804345ab5767a21a787bb6ce2cb809d7212074162898dced0185889bdab

  • SSDEEP

    393216:eiJaOLKo7LhMPsyuk/Z4gHodUQgmCkqyTyt:eiMaM/uk/bMwHyGt

Score
10/10
arrowratasyncrat%group%agilenetpersistencerat

Malware Config

Extracted

Family

arrowrat

Botnet

%Group%

C2

%Hosts%:%Ports%

Mutex

%MTX%

Targets

    • Target

      Venom5-HVNC-Rat.zip

    • Size

      16.1MB

    • MD5

      3a333133b553ea299cab6aea4245e8ea

    • SHA1

      cfa201b7ceee02db2d4cfccb1903b625938b4b5f

    • SHA256

      3dfe4a942287b47f1eb29225788c1b0fc69eb1c1d5acbabd4c10788a2b7d3e52

    • SHA512

      ad582c6f854712bb0b0f703cbb2ca6651b919259eb169bf3892aa32a7f072b5b919fc804345ab5767a21a787bb6ce2cb809d7212074162898dced0185889bdab

    • SSDEEP

      393216:eiJaOLKo7LhMPsyuk/Z4gHodUQgmCkqyTyt:eiMaM/uk/bMwHyGt

    Score
    1/10
    behavioral1

    • Target

      System.Xml.XPath.dll

    • Size

      20KB

    • MD5

      415e3ab72f17f10d646b3e2c7a76f612

    • SHA1

      ed25e94d4e88293345a0f28a5b975159c393b050

    • SHA256

      24daa1faee0478ba58febe8ee789eb88be0a14d350b57ad8b10690c55976b2e1

    • SHA512

      55b5c22b87f21df89d0514ae05c9433b65a3c7532845fdfc4c2c5c5e2c3929d70143d84698fdb4dc13ec01895b1022cf0e5e76e12102739530b54150932a7b07

    • SSDEEP

      384:z6ziqTEkGWvRWtvT1Dm0GftpBjqK4aQHRN7FMlBLY6fMf:zYT1E1DViaLFgYnf

    Score
    1/10
    behavioral2

    • Target

      System.Xml.XmlDocument.dll

    • Size

      21KB

    • MD5

      328d12af9613b0f3f25320b85dcccbf4

    • SHA1

      09d02b85a094e925ac3c5d8b1aca096b730c160f

    • SHA256

      8957f0bcea6ab8a011a53ae62466505199f11a228f87f3809931d974f87078ce

    • SHA512

      16569ecb727ada36811e72ffc925f07aa21b8a627be45f1eda18cf2b759939591dcafcb2d087596ee903c5abffaf19f56f25e9710ef22874c934cad19537b798

    • SSDEEP

      384:jUv7c7iWNCWxvT1Dm0GftpBjvaQHRN7KlBLY6fmV:jM7c1R1DVi5LeYpV

    Score
    1/10
    behavioral3

    • Target

      System.Xml.XmlSerializer.dll

    • Size

      21KB

    • MD5

      d9f02d9f7da653f82e75112a2ab99ce6

    • SHA1

      bbbb4c2c3911ae1f5ba7faf1d632ed0f14d9b6ac

    • SHA256

      21493f7f615a099e795f7fae7ecce6082414d1d427790bdf4b103623a3ab34eb

    • SHA512

      de5546ff103ccc6aa38e254039a372697a193f9c44d0a44f0be3b242d9eef63023dc3fd0c6e8e0d2363177f9230a4e7200d4c32591b398269a1cee9bc47a99fc

    • SSDEEP

      192:3+vxmNWnRW52bivT1CCjdks/nGfe4pBjSrl1WAaAXcrMHnhWgN7aMW2Mqnaj87Xf:GSWnRWDvT1Dm0GftpBjy7aQHRN7IlZ3U

    Score
    1/10
    behavioral4

    • Target

      VenomRAT_HVNC.exe

    • Size

      16.6MB

    • MD5

      5384c0396589430eeb3d1a2e05703e9a

    • SHA1

      20da44da7639bbef2f6b5bfc21df7474cd1109af

    • SHA256

      b4250aff983f1f588593baed1adb4797e6c1ab6225595ebd013b50348a57a459

    • SHA512

      9bf613ee62b0e56af500dd88f572b2221ad6df63b0b4c0dcb0ef763efcebeac633a95f10dfce90f6cff038df2810681dd55dcdd272eb9f907c670cc2e4f7363a

    • SSDEEP

      393216:Al9Yl7Elel7ElAlQleTl/l/l/l/l/lzlml/lqlZlHl/l/l/l/l/l/lIlAl+lUl2L:6TXT

    Score
    10/10
    asyncratagilenetrat

    • AsyncRat

      AsyncRAT is designed to remotely monitor and control other computers written in C#.

      ratasyncrat

    • Async RAT payload

      rat

    • Loads dropped DLL

    • Obfuscated with Agile.Net obfuscator

      Detects use of the Agile.Net commercial obfuscator, which is capable of entity renaming and control flow obfuscation.

      agilenet
    behavioral5

    • Target

      VenomRAT_HVNC.exe.config

    • Size

      2KB

    • MD5

      fa21c166232c3b29f8d2d14557490c9c

    • SHA1

      2cb1a7d4a204fc03bd6bd15aa9f431f3445a08de

    • SHA256

      5c939c46f9d81cb75180c897feb5044176ed44cd0d51e076149bd82425e4ef44

    • SHA512

      cca1dd276a093b62845e5a7652e778d07200b7158cb05a2b44e11e69ce8bc78020eeeb29d55a87a6b87a3fcc25b2883175850467002388a811abfe9945d58fd9

    Score
    1/10
    behavioral6

    • Target

      VenomRAT_HVNC.pdb

    • Size

      927KB

    • MD5

      2364cc04dedcc2ee6b346b1f2e59eb39

    • SHA1

      0d024bb95415848661bef34961c1b343803c6dd9

    • SHA256

      c754a924a7b1df1c44a0dfc330b2e051ef47c03b711e6bf3b499035f3652ad61

    • SHA512

      24b0006cc7ebe8d45cfa7315fafc0d5cc076d83db080cb9173ea4fe4b3458bccdd571f3cec15eddd00492d8d4309a6020037cf7cb663f1410a01aa202a9dfac5

    • SSDEEP

      6144:epiFtsuhGqKJoHtsln+kf8odU5hevcgqo685g6NBd37omeaNbksbaQgBw3isVEUJ:WU7Vuft3C85H5Obq

    Score
    3/10
    behavioral7

    • Target

      Vestris.ResourceLib.dll

    • Size

      76KB

    • MD5

      22fbd571c82399e06e0a7321eedef722

    • SHA1

      ed5aa859dc8141d93a2bd8a8dd14fc50391b66db

    • SHA256

      c05a6f13106e2dd10ae279c3435fb63fbabdc328f94d8065231c3cacfff5fc4b

    • SHA512

      65aa846054a2b0c0dcb2db15273269d8514e000ac67e71542f910d8f556a0ea11e5ab5400b7f2026e5e51fef185d8e12379ac52fa4788c8940727a3721d134d0

    • SSDEEP

      1536:RS0nOie9ZLjnhULE4ocLF3zqvtm0KMtI9eWG3fL+:M0w9ZPnGLEPc1qvtTKr9eHa

    Score
    1/10
    behavioral8

    • Target

      Vestris.ResourceLib.xml

    • Size

      286KB

    • MD5

      5d2dee455b4003b6624b6dd890edb279

    • SHA1

      4cdb025c8c5935bfc49871fca80fc4a346acd579

    • SHA256

      02b4fd6d46ffc9411e4688a5b088fbc7d34062024e1c93637535e093319c35b6

    • SHA512

      90f0123b6300a2fe53b7da8b50253c5807950da96dd0010e2494cc9f14d339d7a131c9653f29a585c2647634537cfbc1a1d84debc33a1b96bf7f01b88eaedee9

    • SSDEEP

      3072:WmVFB8VeEQjvEaXn4chJO2GlUWRLRWIzR:W/VeEQjcaXgdWIzR

    Score
    1/10
    behavioral9

    • Target

      bhatrussia.url

    • Size

      187B

    • MD5

      96cec2ff3bc1281c3b541d549538c9fb

    • SHA1

      3080d0f1e71aca0d10925f692c7f700a6fa16d76

    • SHA256

      cd064a6f7aa46315dea10e6d73bc0416c4954bc8c3fee19a39a2c88c49f3e8ae

    • SHA512

      bf4798a45851d7c0555474e20d26a6fda8112c9be895f674dea49902b5dc3b4d5d9ce9bc5361f16d9b8508198a3f36733b4991cc72553dad3f698e0e0a87a653

    Score
    3/10
    behavioral10

    • Target

      blackhatrussia.url

    • Size

      187B

    • MD5

      ef657464ae10c35ee89c6bfb900d83af

    • SHA1

      1c68b493f87316260e99e3b5b1983fdec0c701b8

    • SHA256

      cfd230d01d6c362a1005d5a530f1807a65ef8497a1246c43c0dfcd5a62022cbf

    • SHA512

      80964f8716653eadf15fcea9bfec0800c4beeee6bc1155b421d51fde813d7752f33a6b33622c1f9f4b5c576c168c6f173349caf03f8e76525aa32251c0d340de

    Score
    3/10
    behavioral11

    • Target

      cGeoIp.dll

    • Size

      2.3MB

    • MD5

      6d6e172e7965d1250a4a6f8a0513aa9f

    • SHA1

      b0fd4f64e837f48682874251c93258ee2cbcad2b

    • SHA256

      d1ddd15e9c727a5ecf78d3918c17aee0512f5b181ad44952686beb89146e6bd0

    • SHA512

      35daa38ad009599145aa241102bcd1f69b4caa55ebc5bb11df0a06567056c0ec5fcd02a33576c54c670755a6384e0229fd2f96622f12304dec58f79e1e834155

    • SSDEEP

      24576:TRgJE8pkCLLe/K43EnnnclQwIqJY0OjklWXQMFBRpmkL/59ah0USm3uwl00odi9p:TRgfX/59a6USdi9Ues6bV6boLO6r

    Score
    1/10
    behavioral12

    • Target

      client.bin

    • Size

      144KB

    • MD5

      f4fdcb900e7af47100ac9e46945fbd55

    • SHA1

      c1d235a9a2cae8d5a8d4f6ceb4eab9417e1b1fb2

    • SHA256

      9160b90fa4a6a9cf22f943dba92cec64e2dc03c2317b5d9ab50a753fc410ce43

    • SHA512

      236eef98d4695a5e1224a87a1dc598639e5c49f6dd192a96cc1b9f8305faa57078deb62d73906a33ba1c1fac4fa5ccc5f344a0f196dbba718b76a36667984ac2

    • SSDEEP

      3072:Bsp9iv+DYM5ob0HGNSKsstcnZTJQDgWPaySsdH5boWz:Op9iTMSb0mgKFcQjhdH

    Score
    10/10
    arrowratasyncrat%group%persistencerat

    • ArrowRat

      Remote access tool with various capabilities first seen in late 2021.

      ratarrowrat

    • AsyncRat

      AsyncRAT is designed to remotely monitor and control other computers written in C#.

      ratasyncrat

    • Async RAT payload

      rat

    • Modifies Installed Components in the registry

      persistence

    • Enumerates connected drives

      Attempts to read the root path of hard drives other than the default C: drive.

    • Suspicious use of SetThreadContext

    behavioral13

    • Target

      dnlib.dll

    • Size

      1.1MB

    • MD5

      4d0b771879de85137ee7e5f0d4bb4b16

    • SHA1

      fc32cccd0cd5c3ebd968bcdf48e32a7ea25e9bd7

    • SHA256

      962332e8c8cb459fb2f7dacec5d7a618cc53b1b49bc1740156398c89742f43fd

    • SHA512

      bae39862ea07ebc5c9aa07a7333a880471baf4bf52eebedc03536e45584887eecc1075e0c0171229a54900ab93a66db9f666aa631c160912f538666da8c9e980

    • SSDEEP

      24576:0eTHIbE7MJp9VuObrLhR4r9gBLKzcWQSv7fwlwhe:U1JoQJR4rm6k

    Score
    1/10
    behavioral14

    • Target

      gbpast - Login.url

    • Size

      107B

    • MD5

      4a4f5be9370e206241bb73bfc2367f3c

    • SHA1

      3d837fdcaa5e3bf04b57600cecb56a9ff34dd8f2

    • SHA256

      210f2ee620fe51acdbe59bba7bb4acbde397034818b09156f6f0874b016a5b18

    • SHA512

      2ba13fe029ac6c5bcfdecf4f9ff6bdbcd64a1129e845c94944b3b35143b8270b8e024b28302750b2214ef82371a70e59fce4226907af240f60d6ad78fb668054

    Score
    1/10
    behavioral15

    • Target

      learn all kind of hacking.url

    • Size

      121B

    • MD5

      7ade4a739cbd8f44d0ef52a2f1bc6e7b

    • SHA1

      20753d483e1a84cb248ba2c0fb72d44137d7d73f

    • SHA256

      cc7649ed53c65e4851ace414529564fe16801bb2bed4cb15588bfd6b4ac13616

    • SHA512

      5850c3d064c9d616854a47b4bd398b76494f1fbe9b356ec5e15879f97dc67970168196ec6b177fa71d15d25d25757a29319cbf9697f3a80461aa62b431d53851

    Score
    1/10
    behavioral16

    • Target

      netstandard.dll

    • Size

      96KB

    • MD5

      0adf6f32f4d14f9b0be9aa94f7efb279

    • SHA1

      68e1af02cddd57b5581708984c2b4a35074982a3

    • SHA256

      8be4a2270f8b2bea40f33f79869fdcca34e07bb764e63b81ded49d90d2b720dd

    • SHA512

      f81ac2895048333ac50e550d2b03e90003865f18058ce4a1dfba9455a5bda2485a2d31b0fdc77f6cbdfb1bb2e32d9f8ab81b3201d96d56e060e4a440719502d6

    • SSDEEP

      1536:Q2Ec05j4eAH64rh5fSt5T9nFcI94WiVQTjpu:nlK4eA7mDmWqQXpu

    Score
    1/10
    behavioral17

    • Target

      packages/Vestris.ResourceLib.2.2.0-beta0004/.signature.p7s

    • Size

      9KB

    • MD5

      008690efa5dcb142f17bf7f97461df25

    • SHA1

      4b56b9178fc8ec56d9f60ee950edbe5379d99c0c

    • SHA256

      96070f8dc2b0ff9bf0d4ae6b78fba4576ca91eb463ec82587bf2a7d933607104

    • SHA512

      24174c7689ea03dac11c60a5983c2e2de29a9adb91a1bd0c661252989a604e88215bff647cb0ef8add15901917b2d084a6bfd34a3801fb3d89729e4a457c0390

    • SSDEEP

      192:IdO7x0KDWpHhXZCVzV07VrKwGDH0JOqsmVgz28WhBqSQcITn:QMvDGGVpzwGoJN77hhLQNTn

    Score
    7/10

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Drops file in System32 directory

    behavioral18

    • Target

      packages/Vestris.ResourceLib.2.2.0-beta0004/Vestris.ResourceLib.2.2.0-beta0004.nupkg

    • Size

      339KB

    • MD5

      849b21794509f4f0f1e0871e9b414bb1

    • SHA1

      f6314c42531dfe4a4564d98a67524b2deeca03c7

    • SHA256

      7296ba826122f5130cbe9f9adf364175a900c34b7803eca7ea4dfee2b0c74ea8

    • SHA512

      065cbf826a3e98bdfc31a1a3e0f5677ab806ecc17167936dafc53105014972d27956770eabbb9703c867ac7cd4261e8cccb73af634836a84aa64656d4c60c721

    • SSDEEP

      6144:hgtVRVBHjugfHBnZqnruscW5fHBnZqw9gfbXMfHBnZqx3wH6zogfHBnZq56bIznQ:EVRjjfHqcGfHL9gTMfHUwHIfHaDfHo

    Score
    3/10
    behavioral19

    • Target

      packages/Vestris.ResourceLib.2.2.0-beta0004/lib/net20/Vestris.ResourceLib.dll

    • Size

      76KB

    • MD5

      2e565b9ecc88100e5815d3fec51311a1

    • SHA1

      41db669f884a03217eea2d6082912d61f1fc2d23

    • SHA256

      6861251df743827aad59af9dbc68b4f43b191c2a0857d222d28a82a9e3aa944a

    • SHA512

      c61b90da4427b5b6005f1b1a7355c6972adfa0ba3818bffeebcdf54f0db13308dcf428455de212b77b22a19b6f41837522a2e316f28daffd71b38276c956c926

    • SSDEEP

      1536:kkLsIDWIaPX5lY9HEVRKxQzRW7RGROLbGVX01zcEWcO99bzIz+GGlxWgLfUB1m5K:kkL1DWIaPX5lY9HEVRKx2RWtGROLbGVo

    Score
    1/10
    behavioral20

    • Target

      packages/Vestris.ResourceLib.2.2.0-beta0004/lib/net20/Vestris.ResourceLib.xml

    • Size

      286KB

    • MD5

      5d2dee455b4003b6624b6dd890edb279

    • SHA1

      4cdb025c8c5935bfc49871fca80fc4a346acd579

    • SHA256

      02b4fd6d46ffc9411e4688a5b088fbc7d34062024e1c93637535e093319c35b6

    • SHA512

      90f0123b6300a2fe53b7da8b50253c5807950da96dd0010e2494cc9f14d339d7a131c9653f29a585c2647634537cfbc1a1d84debc33a1b96bf7f01b88eaedee9

    • SSDEEP

      3072:WmVFB8VeEQjvEaXn4chJO2GlUWRLRWIzR:W/VeEQjcaXgdWIzR

    Score
    1/10
    behavioral21

    • Target

      packages/Vestris.ResourceLib.2.2.0-beta0004/lib/net35/Vestris.ResourceLib.dll

    • Size

      76KB

    • MD5

      4aa661efcbae2aea7050adbeec022d46

    • SHA1

      3f1862f14ba7eb63fe3e24a78dc83a51fc676c7b

    • SHA256

      21e08e7cf51fbe7952f8cf88b924947fd12b01b1ce3405ce2bf6914479f72fc9

    • SHA512

      dda55ffe2345d3222a2bfdef7ad2f904fcabf3d76aefafb9998ba540bc347491ab9d8b7ee55cc94982544f3a7508952809ad7a159fb0cf62697dffe4edfebe11

    • SSDEEP

      1536:CkLsIDWIaPX5lY9HEVRKxQzRW7RGROLbGVX01zcEWcO99bzIz+GGlxWgLfUB1m5p:CkL1DWIaPX5lY9HEVRKx2RWtGROLbGVP

    Score
    1/10
    behavioral22

    • Target

      packages/Vestris.ResourceLib.2.2.0-beta0004/lib/net35/Vestris.ResourceLib.xml

    • Size

      286KB

    • MD5

      5d2dee455b4003b6624b6dd890edb279

    • SHA1

      4cdb025c8c5935bfc49871fca80fc4a346acd579

    • SHA256

      02b4fd6d46ffc9411e4688a5b088fbc7d34062024e1c93637535e093319c35b6

    • SHA512

      90f0123b6300a2fe53b7da8b50253c5807950da96dd0010e2494cc9f14d339d7a131c9653f29a585c2647634537cfbc1a1d84debc33a1b96bf7f01b88eaedee9

    • SSDEEP

      3072:WmVFB8VeEQjvEaXn4chJO2GlUWRLRWIzR:W/VeEQjcaXgdWIzR

    Score
    1/10
    behavioral23

    • Target

      packages/Vestris.ResourceLib.2.2.0-beta0004/lib/net40/Vestris.ResourceLib.dll

    • Size

      76KB

    • MD5

      1d4ac765c46e8474583b3bbeba088f74

    • SHA1

      8f2db7e48158a88d9fa49b888a4b20f93c8b2e0c

    • SHA256

      3b3c0be681d7603cc1c5e3c5f1d8614a582dd82b2465f7f42d79c5ae57f7f642

    • SHA512

      cbdca62b58f8855c92edbda5d926787157c16cf46ab5f8d5cad23176fc1157f19531347c4426de5a7e12198eba440ee69d06e46dea1efc6f1e5fab9b4764a5c7

    • SSDEEP

      1536:GerfdUE9L8kT5j6fk4FhYeuMtIxeTanr+:jfJL825QthrurxeWa

    Score
    1/10
    behavioral24

    • Target

      packages/Vestris.ResourceLib.2.2.0-beta0004/lib/net40/Vestris.ResourceLib.xml

    • Size

      286KB

    • MD5

      5d2dee455b4003b6624b6dd890edb279

    • SHA1

      4cdb025c8c5935bfc49871fca80fc4a346acd579

    • SHA256

      02b4fd6d46ffc9411e4688a5b088fbc7d34062024e1c93637535e093319c35b6

    • SHA512

      90f0123b6300a2fe53b7da8b50253c5807950da96dd0010e2494cc9f14d339d7a131c9653f29a585c2647634537cfbc1a1d84debc33a1b96bf7f01b88eaedee9

    • SSDEEP

      3072:WmVFB8VeEQjvEaXn4chJO2GlUWRLRWIzR:W/VeEQjcaXgdWIzR

    Score
    1/10
    behavioral25

    • Target

      packages/Vestris.ResourceLib.2.2.0-beta0004/lib/net45/Vestris.ResourceLib.dll

    • Size

      76KB

    • MD5

      22fbd571c82399e06e0a7321eedef722

    • SHA1

      ed5aa859dc8141d93a2bd8a8dd14fc50391b66db

    • SHA256

      c05a6f13106e2dd10ae279c3435fb63fbabdc328f94d8065231c3cacfff5fc4b

    • SHA512

      65aa846054a2b0c0dcb2db15273269d8514e000ac67e71542f910d8f556a0ea11e5ab5400b7f2026e5e51fef185d8e12379ac52fa4788c8940727a3721d134d0

    • SSDEEP

      1536:RS0nOie9ZLjnhULE4ocLF3zqvtm0KMtI9eWG3fL+:M0w9ZPnGLEPc1qvtTKr9eHa

    Score
    1/10
    behavioral26

    • Target

      packages/Vestris.ResourceLib.2.2.0-beta0004/lib/net45/Vestris.ResourceLib.xml

    • Size

      286KB

    • MD5

      5d2dee455b4003b6624b6dd890edb279

    • SHA1

      4cdb025c8c5935bfc49871fca80fc4a346acd579

    • SHA256

      02b4fd6d46ffc9411e4688a5b088fbc7d34062024e1c93637535e093319c35b6

    • SHA512

      90f0123b6300a2fe53b7da8b50253c5807950da96dd0010e2494cc9f14d339d7a131c9653f29a585c2647634537cfbc1a1d84debc33a1b96bf7f01b88eaedee9

    • SSDEEP

      3072:WmVFB8VeEQjvEaXn4chJO2GlUWRLRWIzR:W/VeEQjcaXgdWIzR

    Score
    1/10
    behavioral27

    • Target

      packages/Vestris.ResourceLib.2.2.0-beta0004/lib/netstandard2.0/Vestris.ResourceLib.dll

    • Size

      76KB

    • MD5

      61ddea15b7ac8c8f92893ef321867d27

    • SHA1

      ea6835a6616f8a3dc07f82eb70111520a7b78c8e

    • SHA256

      372103129856911388bfea0dc0d6934b645223e3e3e4e8280228abda9382030e

    • SHA512

      1ee0196a52e50339b9d0fc68036a58f826b2be1095360ef299d2be5bb9a9a56c46f163094c912115f6c80b200caf6bcef74ce6ad45fbb74fb8f80d33d6ac3eb5

    • SSDEEP

      1536:s6NFUznwH9enK/JRu00SdfOUWz9Mthne5h+fLu:9NX9eYFdWUc9Unen/

    Score
    1/10
    behavioral28

    • Target

      packages/Vestris.ResourceLib.2.2.0-beta0004/lib/netstandard2.0/Vestris.ResourceLib.xml

    • Size

      286KB

    • MD5

      5d2dee455b4003b6624b6dd890edb279

    • SHA1

      4cdb025c8c5935bfc49871fca80fc4a346acd579

    • SHA256

      02b4fd6d46ffc9411e4688a5b088fbc7d34062024e1c93637535e093319c35b6

    • SHA512

      90f0123b6300a2fe53b7da8b50253c5807950da96dd0010e2494cc9f14d339d7a131c9653f29a585c2647634537cfbc1a1d84debc33a1b96bf7f01b88eaedee9

    • SSDEEP

      3072:WmVFB8VeEQjvEaXn4chJO2GlUWRLRWIzR:W/VeEQjcaXgdWIzR

    Score
    1/10
    behavioral29

    • Target

      protobuf-net.dll

    • Size

      269KB

    • MD5

      4a4756e227c10623d81228bc4bc49c1d

    • SHA1

      964014f538918d85f6eb6a7b4023b304067b28f7

    • SHA256

      042b8c1c1e0eb7648b164ee48c95168c48324f1fb439cabd5f2e41db0938d807

    • SHA512

      93d2c6f47c618dc9493f5a538cbfb5a32c1e3bb35a623b51561057245f2fa557c452ee18ae274182c3e0440b77353c5490d196f16eda142b6129e8d1108e5a04

    • SSDEEP

      3072:2ne8csJldhXG4JhEj9n8RHq6MY7qLfoDb4LUcqbrKKu55O/u85wcT/0c8yiwo3aa:2nT7JxXJ7qFLMrKXE/9YLy1W2WNU6

    Score
    1/10
    behavioral30

    • Target

      readme.txt

    • Size

      740B

    • MD5

      4dc812ec4ed8b9f6b117eebf783d78cc

    • SHA1

      4f17b61b3693b3469e61781af895e7e437a6e5ad

    • SHA256

      8746b7b6305d3fd5d986fab51e9db647319b5673bb96b7d8082e416ab2508b03

    • SHA512

      92c9215d387f0c29147d69d47f4a07ac1f093504eb14e63160838001d179e164c51efe1459a269a396263edf6bc1c4faea206671591ee728b907506f034c7d15

    Score
    1/10
    behavioral31

    • Target

      svchost.exe

    • Size

      9KB

    • MD5

      f83c1904404d2b40622d28a5c05420f9

    • SHA1

      87c629c25b2be94ff603fd4b5e1934541006cc44

    • SHA256

      58fa8679eb278c0fbe4b9348e61cd274234037af160878289a988260eaf6246e

    • SHA512

      cb8dedaa9510e466a6babb984913130271baaccc68ccb432e6318e0791547eb6d54d3b61103b9ab39a530d15e6187a580062fe9e5c1442df5d976ee7850448a3

    • SSDEEP

      192:/vnBrHsNjxAPGuPKm7gfsAq6/apEu74DFRO9e:/vnBrMw+uPK/Pq6/876y9

    Score
    7/10

    • Drops startup file

    behavioral32

MITRE ATT&CK Enterprise v15

Tasks

static1

agilenetrat%group%asyncratarrowrat
Score
10/10

behavioral1

Score
1/10

behavioral2

Score
1/10

behavioral3

Score
1/10

behavioral4

Score
1/10

behavioral5

asyncratagilenetrat
Score
10/10

behavioral6

Score
1/10

behavioral7

Score
3/10

behavioral8

Score
1/10

behavioral9

Score
1/10

behavioral10

Score
3/10

behavioral11

Score
3/10

behavioral12

Score
1/10

behavioral13

arrowratasyncrat%group%persistencerat
Score
10/10

behavioral14

Score
1/10

behavioral15

Score
1/10

behavioral16

Score
1/10

behavioral17

Score
1/10

behavioral18

Score
7/10

behavioral19

Score
3/10

behavioral20

Score
1/10

behavioral21

Score
1/10

behavioral22

Score
1/10

behavioral23

Score
1/10

behavioral24

Score
1/10

behavioral25

Score
1/10

behavioral26

Score
1/10

behavioral27

Score
1/10

behavioral28

Score
1/10

behavioral29

Score
1/10

behavioral30

Score
1/10

behavioral31

Score
1/10

behavioral32

Score
7/10