Static

static

10

Sharing

Copy URL Twitter E-mail

General

  • Target

    S500 RAT.rar

  • Size

    95.4MB

  • MD5

    3dd723f8893d8a8890b9e56829b846c5

  • SHA1

    cbdc43a3f3ab09f12723fa1625214e6b0298b09e

  • SHA256

    2059ca0b52b408e89bc09346440653c1027d7b76137a052ab4f59e9e0d03b59c

  • SHA512

    9ce1ca2c17aec8edbc79b1574c41862dd6656b2a51ef3b61353459593c8b9f0ea9175257ca88042229c0d14f7f805351d449b259fb13d154b2dc294d0815d35a

  • SSDEEP

    1572864:f5HeR1dL4/4rzOchP9+GjrloGnNLkXDCEYjiaBxJDg/PEi+EeWqyR+b6gLwPVVD4:f5+10kqcd9+o2GEYeaBx+b5qyRt5Ja/

Score
10/10
agilenetratdefaultasyncrat

Malware Config

Extracted

Family

asyncrat

Version

Venom RAT + HVNC + Stealer + Grabber v6.0.3

Botnet

Default

C2

147.185.221.17:25274

Mutex

ifspwtzbsypoakpi

Attributes
  • delay

    1

  • install

    false

  • install_folder

    %AppData%

aes.plain

Signatures

  • Async RAT payload 1 IoCs
    rat
  • Asyncrat family
    asyncrat
  • Obfuscated with Agile.Net obfuscator 1 IoCs

    Detects use of the Agile.Net commercial obfuscator, which is capable of entity renaming and control flow obfuscation.

    agilenet
  • Unsigned PE 24 IoCs

    Checks for missing Authenticode signature.

Files

  • S500 RAT.rar
    .rar
  • .exe
    .exe windows:4 windows x86 arch:x86

    b34f154ec913d2d2c435cbd644e91687


    Code Sign

    Headers

    Imports

    Sections

  • .peu/New Project 1/compile.log
  • .peu/New Project 1/src/Api/kernel32.inc
  • .peu/New Project 1/src/Api/msvcrt.inc
  • .peu/New Project 1/src/Api/shlwapi.inc
  • .peu/New Project 1/src/Compression.asm
  • .peu/New Project 1/src/Download.asm
  • .peu/New Project 1/src/Drop.asm
  • .peu/New Project 1/src/Emulator.asm
  • .peu/New Project 1/src/Melt.asm
  • .peu/New Project 1/src/Obfuscator/nop.txt
  • .peu/New Project 1/src/Obfuscator/nop_minimal.txt
  • .peu/New Project 1/src/Obfuscator/register.txt
  • .peu/New Project 1/src/PebApi.asm
  • .peu/New Project 1/src/PebApi.inc
    .vbs
  • .peu/New Project 1/src/Resources/default.manifest
    .xml
  • .peu/New Project 1/src/Resources/elevated.manifest
    .xml
  • .peu/New Project 1/src/RunPE.asm
  • .peu/New Project 1/src/Stage2.asm
  • .peu/New Project 1/src/Stub.asm
  • .peu/New Project 1/src/nt.inc
  • BouncyCastle.Crypto.dll
    .dll windows:4 windows x86 arch:x86

    dae02f32a21e03ce65412f6e56942daa


    Headers

    Imports

    Sections

  • Certificate/BackupCertificate.zip
    .zip
  • ServerCertificate.p12
  • Certificate/ServerCertificate.p12
  • Chrome.ico
  • Clients/Downloads/A82871D5B4CE1A95/1.DAT
  • Clients/Downloads/A82871D5B4CE1A95/10.DAT
  • Clients/Downloads/A82871D5B4CE1A95/11.DAT
  • Clients/Downloads/A82871D5B4CE1A95/2.DAT
  • Clients/Downloads/A82871D5B4CE1A95/5.DAT
  • Clients/Downloads/A82871D5B4CE1A95/7.DAT
  • Compression7zip.dll
    .dll windows:4 windows x86 arch:x86

    dae02f32a21e03ce65412f6e56942daa


    Headers

    Imports

    Sections

  • FastColoredTextBox.dll
    .dll windows:4 windows x86 arch:x86

    dae02f32a21e03ce65412f6e56942daa


    Headers

    Imports

    Sections

  • Gry73.dll
    .dll windows:4 windows x86 arch:x86

    dae02f32a21e03ce65412f6e56942daa


    Headers

    Imports

    Sections

  • Guna.UI2.dll
    .dll windows:4 windows x86 arch:x86

    dae02f32a21e03ce65412f6e56942daa


    Code Sign

    Headers

    Imports

    Sections

  • LiveCharts.Wpf.dll
    .dll windows:4 windows x86 arch:x86

    dae02f32a21e03ce65412f6e56942daa


    Headers

    Imports

    Sections

  • LiveCharts.dll
    .dll windows:4 windows x86 arch:x86

    dae02f32a21e03ce65412f6e56942daa


    Headers

    Imports

    Sections

  • MetroFramework.dll
    .dll windows:4 windows x86 arch:x86

    dae02f32a21e03ce65412f6e56942daa


    Headers

    Imports

    Sections

  • New Project 1.peu
  • Obfuscation.dll
    .dll windows:4 windows x86 arch:x86

    dae02f32a21e03ce65412f6e56942daa


    Headers

    Imports

    Sections

  • Plugins/ActiveWindows.dll
  • Plugins/Admin.dll
  • Plugins/AntiMalware.dll
  • Plugins/BotsKiller.dll
  • Plugins/Chat.dll
  • Plugins/Clipboard.dll
  • Plugins/Cmd.dll
  • Plugins/DDos.dll
  • Plugins/DotNet.dll
  • Plugins/File Manager.dll
  • Plugins/FileManager.dll
  • Plugins/Fun.dll
  • Plugins/HBrowser.dll
  • Plugins/HRDP.dll
  • Plugins/HVNC.dll
  • Plugins/Helper.dll
  • Plugins/HiddenApps.dll
  • Plugins/HiddenProgram.dll
  • Plugins/Hosts.dll
  • Plugins/IconLib.dll
  • Plugins/Information.dll
  • Plugins/Installedsoftwares.dll
  • Plugins/Keylogger.dll
  • Plugins/MessageBox.dll
  • Plugins/Mic.dll
  • Plugins/Mining.dll
  • Plugins/Options.dll
  • Plugins/Password.dll
  • Plugins/Powershell.dll
  • Plugins/Ransomware.dll
  • Plugins/RecoviryPasswords.dll
  • Plugins/Regedit.dll
  • Plugins/RegistryEditor.dll
  • Plugins/RemoteCamera.dll
  • Plugins/RemoteDesktop.dll
  • Plugins/ReverseProxy.dll
  • Plugins/SClient.dll
  • Plugins/SendFile.dll
  • Plugins/Services.dll
  • Plugins/Startup.dll
  • Plugins/StreamLib.dll
  • Plugins/TCPConnection.dll
  • Plugins/TaskManager.dll
  • Plugins/USBSpread.dll
  • Plugins/User ID.dll
  • Plugins/WiFi.dll
  • Plugins/lz4.AnyCPU.loader.dll
  • Plugins/protobuf-net.dll
  • QuickLZLibrary.dll
    .dll windows:4 windows x86 arch:x86

    dae02f32a21e03ce65412f6e56942daa


    Headers

    Imports

    Sections

  • S500 RAT.exe
    .exe windows:4 windows x86 arch:x86

    f34d5f2d4577ed6d9ceec516c1f5a744


    Headers

    Imports

    Sections

  • Socks5.dll
    .dll windows:4 windows x86 arch:x86

    dae02f32a21e03ce65412f6e56942daa


    Headers

    Imports

    Sections

  • SunnyUI.Common.dll
    .dll windows:4 windows x86 arch:x86

    dae02f32a21e03ce65412f6e56942daa


    Headers

    Imports

    Sections

  • SunnyUI.dll
    .dll windows:4 windows x86 arch:x86

    dae02f32a21e03ce65412f6e56942daa


    Headers

    Imports

    Sections

  • Svg.dll
    .dll windows:4 windows x86 arch:x86

    dae02f32a21e03ce65412f6e56942daa


    Headers

    Imports

    Sections

  • Terror/1.gif
    .gif
  • Terror/2.gif
    .gif .ps1
  • Terror/3.gif
    .gif
  • Terror/4.gif
    .gif
  • Terror/T.wav
  • Tulpep.NotificationWindow.dll
    .dll windows:4 windows x86 arch:x86

    dae02f32a21e03ce65412f6e56942daa


    Headers

    Imports

    Sections

  • Vestris.ResourceLib.dll
    .dll windows:4 windows x86 arch:x86

    dae02f32a21e03ce65412f6e56942daa


    Headers

    Imports

    Sections

  • WinMic.dll
    .dll windows:4 windows x86 arch:x86

    dae02f32a21e03ce65412f6e56942daa


    Headers

    Imports

    Sections

  • WinSound.dll
    .dll windows:4 windows x86 arch:x86

    dae02f32a21e03ce65412f6e56942daa


    Headers

    Imports

    Sections

  • cGeoIp.dll
    .dll windows:4 windows x86 arch:x86

    dae02f32a21e03ce65412f6e56942daa


    Headers

    Imports

    Sections

  • dnlib.dll
    .dll windows:4 windows x86 arch:x86

    dae02f32a21e03ce65412f6e56942daa


    Headers

    Imports

    Sections

  • initialization.dll
    .dll windows:4 windows x86 arch:x86

    dae02f32a21e03ce65412f6e56942daa


    Headers

    Imports

    Sections

  • lz4.AnyCPU.loader.dll
    .dll windows:4 windows x86 arch:x86

    dae02f32a21e03ce65412f6e56942daa


    Headers

    Imports

    Sections

  • protobuf-net.dll
    .dll windows:4 windows x86 arch:x86

    dae02f32a21e03ce65412f6e56942daa


    Headers

    Imports

    Sections

  • settings.xml
  • zxing.dll
    .dll windows:4 windows x86 arch:x86

    dae02f32a21e03ce65412f6e56942daa


    Headers

    Imports

    Sections