General

  • Target
    VENOM-RAT.zip
  • Size 111.6MB
  • Sample240304-3pp89shd79
  • SHA256 bff85f049a7cddb710a045ed409bf8ab526c4f86b379adf2e6fc32207cdf87e3
  • MD5 SHA1 SHA512 SSDEEP

Malware Config

Extracted

Family
  • asyncrat

Version
  • 1.0.7

Botnet
  • Default

C2
  • 95.216.52.21:7575

Mutex
  • xdnqiaxygefjfoolgo

Attributes
  • delay

    1

  • install

    false

  • install_folder

    %AppData%

aes.plain

Targets

    • Target
      BouncyCastle.Crypto.dll
    • Size 2.5MB
    • SHA256 333903c7d22a27098e45fc64b77a264aa220605cfbd3e329c200d7e4b42c881c
    • MD5 SHA1 SHA512 SSDEEP
    Score
    1/10
    • Target
      Client.exe
    • Size 66KB
    • SHA256 3a7efdc3d85adf7a5484ef17549db47be2a78b4b6892d93dd91958bb9a9edb82
    • MD5 SHA1 SHA512 SSDEEP
    Score
    10/10
    • AsyncRat

      AsyncRAT is designed to remotely monitor and control other computers written in C#.

    • Target
      DevExpress.Charts.v22.2.Core.dll
    • Size 1023KB
    • SHA256 de682a0d612ec7d45a0accd8fbbb90db374d652ec68b52317170082a2afe7f31
    • MD5 SHA1 SHA512 SSDEEP
    Score
    1/10
    • Target
      DevExpress.CodeParser.v22.2.dll
    • Size 1.7MB
    • SHA256 aa74c8d4b98543a9f277860c7d11a64d762b4dd20d93acdbe0e4193fb69d5245
    • MD5 SHA1 SHA512 SSDEEP
    Score
    1/10
    • Target
      DevExpress.Data.Desktop.v22.1.dll
    • Size 838KB
    • SHA256 d13e0c266cb9b98a911bbb87fd94cd9e5125e3bff93bb9b1032271e7507ef2f6
    • MD5 SHA1 SHA512 SSDEEP
    Score
    1/10
    • Target
      DevExpress.Data.Desktop.v22.2.dll
    • Size 912KB
    • SHA256 d405116805f243c6852b06b70e9cfca68837a2eb918d53247c6ae69c21b093a2
    • MD5 SHA1 SHA512 SSDEEP
    Score
    1/10
    • Target
      DevExpress.Data.v22.1.dll
    • Size 5.0MB
    • SHA256 e8d4940767c992e14acb77ba1140d5dac56683afe5096e1b08408b0767466e33
    • MD5 SHA1 SHA512 SSDEEP
    Score
    1/10
    • Target
      DevExpress.Data.v22.2.dll
    • Size 5.1MB
    • SHA256 02653d88be212ba3753ee8e87c13159a2ce48250c6c7a05f21091924eb6953d2
    • MD5 SHA1 SHA512 SSDEEP
    Score
    1/10
    • Target
      DevExpress.DataAccess.v22.2.UI.dll
    • Size 1.1MB
    • SHA256 f8a4f0ce3e38e1e750ce84231423600dbda276ba561f1a3bfc0ca142c7bc502a
    • MD5 SHA1 SHA512 SSDEEP
    Score
    1/10
    • Target
      DevExpress.DataAccess.v22.2.dll
    • Size 2.3MB
    • SHA256 2eac960681b6b3193945215060cb3b4e2b7483304566dbbe74a683e893c7e022
    • MD5 SHA1 SHA512 SSDEEP
    Score
    1/10
    • Target
      DevExpress.DataVisualization.v22.2.Core.dll
    • Size 70KB
    • SHA256 ec3b83363fc251a586c5520f3d617b3f1702ee92995dcd6e4c68e2f44e0896f7
    • MD5 SHA1 SHA512 SSDEEP
    Score
    1/10
    • Target
      DevExpress.Diagram.v22.2.Core.dll
    • Size 3.0MB
    • SHA256 e971be0ba001e66a202c4486c1cfda6141fa9b62571ef00f9929f945e76229fd
    • MD5 SHA1 SHA512 SSDEEP
    Score
    1/10
    • Target
      DevExpress.Dialogs.v22.2.Core.dll
    • Size 927KB
    • SHA256 ee75eeabe9f077371a321077e0a6dd0a7b00d33794ff3b3b7210ac56a6b326eb
    • MD5 SHA1 SHA512 SSDEEP
    Score
    1/10
    • Target
      DevExpress.Drawing.v22.1.dll
    • Size 291KB
    • SHA256 bc0d40dcdcc9f3e2e7b7071ffb033811bb094cc6a63907c994acd5415b577930
    • MD5 SHA1 SHA512 SSDEEP
    Score
    1/10
    • Target
      DevExpress.Drawing.v22.2.dll
    • Size 598KB
    • SHA256 41b3baffaec9eed640cf10d917d3d912685001a7e3a963e2872c85a74d55100c
    • MD5 SHA1 SHA512 SSDEEP
    Score
    1/10
    • Target
      DevExpress.Images.v22.1.dll
    • Size 8.4MB
    • SHA256 67a7db033d6047d8345182233f6d314c3ff1547dccaf5b8c04d71e1c8d8faa57
    • MD5 SHA1 SHA512 SSDEEP
    Score
    1/10
    • Target
      DevExpress.Images.v22.2.dll
    • Size 8.2MB
    • SHA256 90d34d161ebadd1ebf75e4e10855635f8d5c83bac2829abdeebb6d082d9ce3ad
    • MD5 SHA1 SHA512 SSDEEP
    Score
    1/10
    • Target
      DevExpress.Mvvm.v22.2.dll
    • Size 1.5MB
    • SHA256 efdae289d4215896dca0b74a4084d17926693e7555807a1373d015f6dd1a3e65
    • MD5 SHA1 SHA512 SSDEEP
    Score
    1/10
    • Target
      DevExpress.Office.v22.1.Core.dll
    • Size 3.7MB
    • SHA256 10c2ef3e11a2a2cdac160d4299cd541d6b1f75613ae7adec7689e71d365f7e21
    • MD5 SHA1 SHA512 SSDEEP
    Score
    1/10
    • Target
      DevExpress.Office.v22.2.Core.dll
    • Size 3.7MB
    • SHA256 ff553a31694d7043aacbbcda3ec41377ddc036c506520db7331fe3ba8e3a39b6
    • MD5 SHA1 SHA512 SSDEEP
    Score
    1/10
    • Target
      DevExpress.Pdf.v22.1.Core.dll
    • Size 5.1MB
    • SHA256 0704e6abdd582e23b37a7bdfd298b914038e43477f2e0bc271b012185a5e71c4
    • MD5 SHA1 SHA512 SSDEEP
    Score
    1/10
    • Target
      DevExpress.Pdf.v22.1.Drawing.dll
    • Size 502KB
    • SHA256 f98ad5274cc55f675c60a61d74a4d213a30c00e466537ee852d75c5f390ce7c3
    • MD5 SHA1 SHA512 SSDEEP
    Score
    1/10
    • Target
      DevExpress.Pdf.v22.2.Core.dll
    • Size 4.9MB
    • SHA256 084983a6412c967de89f28ab605197d42f682485ac73ac31e2ed1b28533cc63f
    • MD5 SHA1 SHA512 SSDEEP
    Score
    1/10
    • Target
      DevExpress.Pdf.v22.2.Drawing.dll
    • Size 501KB
    • SHA256 a694db9952459b0d2de2a390a0def2607a56ffeefda17578cd944bdb312475c9
    • MD5 SHA1 SHA512 SSDEEP
    Score
    1/10
    • Target
      DevExpress.PivotGrid.v22.2.Core.dll
    • Size 3.6MB
    • SHA256 0a5a09245a3c18574de1797547b8685f596ceccf627cf7e530b9b8cb1e43011d
    • MD5 SHA1 SHA512 SSDEEP
    Score
    1/10
    • Target
      DevExpress.Printing.v22.1.Core.dll
    • Size 4.5MB
    • SHA256 e4d60cac9cacde3cab841854b4c5348df89a4e4027b62de09184a3ddbb81a5a0
    • MD5 SHA1 SHA512 SSDEEP
    Score
    1/10
    • Target
      DevExpress.Printing.v22.2.Core.dll
    • Size 4.5MB
    • SHA256 dde47834faa880478fc40fe9e2c021886ecc532ee064b163f93136bb85495452
    • MD5 SHA1 SHA512 SSDEEP
    Score
    1/10
    • Target
      DevExpress.RichEdit.v22.1.Core.dll
    • Size 8.4MB
    • SHA256 078551cc3b00963dcfae8bcf69f8e926cf67234fc3c688fffccc195b4a611976
    • MD5 SHA1 SHA512 SSDEEP
    Score
    1/10
    • Target
      DevExpress.RichEdit.v22.2.Core.dll
    • Size 8.4MB
    • SHA256 aab6a1b65130888dbd2f64be8cf4b43049f4feb28d81e66b9ea62ae379f736b0
    • MD5 SHA1 SHA512 SSDEEP
    Score
    1/10
    • Target
      DevExpress.RichEdit.v22.2.Export.dll
    • Size 252KB
    • SHA256 40ec3f329794a78585674306f6645af386d0e0cef7accf6f3ac4b9c4f8511291
    • MD5 SHA1 SHA512 SSDEEP
    Score
    1/10
    • Target
      DevExpress.Sparkline.v22.1.Core.dll
    • Size 87KB
    • SHA256 bf03f577ecb257067abee5e7b6e49803a309231701cd07a39caa210d5c886c4c
    • MD5 SHA1 SHA512 SSDEEP
    Score
    1/10
    • Target
      DevExpress.Sparkline.v22.2.Core.dll
    • Size 88KB
    • SHA256 449953a7fb470b18a37c36d321dc61a1c6bed8e039ee8415cc37315ae44f60b0
    • MD5 SHA1 SHA512 SSDEEP
    Score
    1/10

MITRE ATT&CK Matrix

Tasks

static1

ratdefaultasyncratstormkitty
Score
10/10

behavioral1

Score
1/10

behavioral2

asyncratdefaultrat
Score
10/10

behavioral3

Score
1/10

behavioral4

Score
1/10

behavioral5

Score
1/10

behavioral6

Score
1/10

behavioral7

Score
1/10

behavioral8

Score
1/10

behavioral9

Score
1/10

behavioral10

Score
1/10

behavioral11

Score
1/10

behavioral12

Score
1/10

behavioral13

Score
1/10

behavioral14

Score
1/10

behavioral15

Score
1/10

behavioral16

Score
1/10

behavioral17

Score
1/10

behavioral18

Score
1/10

behavioral19

Score
1/10

behavioral20

Score
1/10

behavioral21

Score
1/10

behavioral22

Score
1/10

behavioral23

Score
1/10

behavioral24

Score
1/10

behavioral25

Score
1/10

behavioral26

Score
1/10

behavioral27

Score
1/10

behavioral28

Score
1/10

behavioral29

Score
1/10

behavioral30

Score
1/10

behavioral31

Score
1/10

behavioral32

Score
1/10