Overview

overview

10

Static

static

1

$RECYCLE.B...CZ.url

windows7-x64

1

$RECYCLE.B...CZ.url

windows10-2004-x64

1

$RECYCLE.B...JO.url

windows7-x64

1

$RECYCLE.B...JO.url

windows10-2004-x64

1

$RECYCLE.B...G6.lnk

windows7-x64

3

$RECYCLE.B...G6.lnk

windows10-2004-x64

3

$RECYCLE.B...CZ.url

windows7-x64

1

$RECYCLE.B...CZ.url

windows10-2004-x64

1

$RECYCLE.B...JO.url

windows7-x64

1

$RECYCLE.B...JO.url

windows10-2004-x64

1

$RECYCLE.B...G6.lnk

windows7-x64

3

$RECYCLE.B...G6.lnk

windows10-2004-x64

3

INVOICE#TB...SA.lnk

windows7-x64

3

INVOICE#TB...SA.lnk

windows10-2004-x64

10

zay/INVOIC...SA.cmd

windows7-x64

1

zay/INVOIC...SA.cmd

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    invoice.vhd

  • Size

    12.0MB

  • Sample

    240320-x8mplahg7w

  • MD5

    dcf8710054901cbd3a33505d87a69a73

  • SHA1

    095b72082aa2c2bba21006210313dc777db1849d

  • SHA256

    aecc170d48ec2d3fa2130670b854066f0b5664a6302516e3f3d8ba3ab06e1fa8

  • SHA512

    ecd513931f85ce6744507ac3cf288e7f12afe07e928c1774102072b313432bdb58608fc46e1239ef9393468625a618958bb3be31d7f8a99b7b76cada49836071

  • SSDEEP

    6144:PV6lGC6H45QtiLJfhB+ZVBGIXcSIsnXy2wg9f5ZezrKWTPd:6LzCnyRqf5szrKQPd

Score
10/10
asyncratvenom clientsrat

Malware Config

Extracted

Family

asyncrat

Version

5.0.5

Botnet

Venom Clients

C2

kdfsv.duckdns.org:8890

Mutex

Venom_RAT_HVNC_Mutex_Venom RAT_HVNC

Attributes
  • delay

    1

  • install

    false

  • install_folder

    %AppData%

aes.plain

Targets

    • Target

      $RECYCLE.BIN/$I6AKHCZ.url

    • Size

      92B

    • MD5

      d9f53e37a6a7d47fc086d8a37a74e801

    • SHA1

      d651093a093789c29b04a8c17fdb9ab4443dbedd

    • SHA256

      dd9e36990c4d19966f744f3e23399b62189ffb6d76ecc1981d65942af483fb51

    • SHA512

      c902da67505b9ca4cd02cceda1571ce77f3f95eb94148dbc7894db97921e39b6eac57a91a48ea61bea2f90039f1cf3a5f5633472bfdc8fda75e437aa17c0cfb9

    Score
    1/10
    behavioral1behavioral2

    • Target

      $RECYCLE.BIN/$I9BVFJO.url

    • Size

      84B

    • MD5

      106364071e4178bb725e479c5ae733fe

    • SHA1

      1f1ab2ebe4289d271b548e73307d51dd7aac3e06

    • SHA256

      421d1cba483e5beef4205ffa43ce32dd1559d4d46fc65ea05d665a1fca8b42ff

    • SHA512

      f767a13eb19e92de917cdaaaa01627b4ccafb69a8b49e6ea6e4ca0a073e5c385962b82744b327961b3a4a4a7dd0b4f13aac9de44dd1c41934b37a7b8a22d49fa

    Score
    1/10
    behavioral3behavioral4

    • Target

      $RECYCLE.BIN/$IAEXCG6.lnk

    • Size

      80B

    • MD5

      6c10870c38d8541ac9fe32cf2df303ea

    • SHA1

      919449d2399a83e54284e32ca0cd30efe617627b

    • SHA256

      20c1afbfe809c840bd81cd150f455ad6ee300a1ecbd0fc3797c656d0f13d17fe

    • SHA512

      b11bdb44d2799454d8a65d8878e60a5a8fbcf81385b529b8f08abf0cec30aa8bb005a00d966f0e8dee66596d2a6b789631cd7edf63fd5cb2f046a09e9ba795a5

    Score
    3/10
    behavioral5behavioral6

    • Target

      $RECYCLE.BIN/$R6AKHCZ.url

    • Size

      141B

    • MD5

      0de440fa9e6012b525dbddeea04f5fbd

    • SHA1

      e8a74bf4989eee88a071057b3ed402b7662df498

    • SHA256

      5bb39c8f533ef487b406d3195a274bba69e538a4d3b49b7f80e8fa6b4804c0e6

    • SHA512

      c416da23e60c9183d6193fcc8137196f02d3db0a662c7a5802630177cd7cfc7afc3d052778b576f12d2a68620ddf922d72810a11a24bab6c8c6e06c0cd697715

    Score
    1/10
    behavioral7behavioral8

    • Target

      $RECYCLE.BIN/$R9BVFJO.url

    • Size

      192B

    • MD5

      30b15d0074689b2b57391607ce87184d

    • SHA1

      a8bb35e64db7774eecd9bc9c684677215cbd22ff

    • SHA256

      be7c237538f353211d999453405525df568567de5674dc1ffda5773a7cb0be8b

    • SHA512

      9aa9dd3bfefc57297390763715ddc2882797a37dcdfa619ba41cced889f864f88bba18c130e6fc2d15293abc8e884ef8cbfba48371205b62a87ca583357db465

    Score
    1/10
    behavioral10behavioral9

    • Target

      $RECYCLE.BIN/$RAEXCG6.lnk

    • Size

      764B

    • MD5

      50ca4a3117112b2921ca0dd1d2669b3f

    • SHA1

      523f7011bd9bd86930c055ddf92441d441bf9043

    • SHA256

      2f0ff66fb95769969f2036a205033f6868da8ebd1a211c45a8afc3f805940a69

    • SHA512

      33db76a36c9a27c1344e7d39fa55fb9be4a047785d10ac48f272d15fc9b30f67a2994117bd4b2f33662ad0f3b747aee85ef9a41f4242744ca974a8e066e59143

    Score
    3/10
    behavioral11behavioral12

    • Target

      INVOICE#TBSAOKHBSA.lnk

    • Size

      944B

    • MD5

      c500f65d596f13de0b45916fd38b2ebf

    • SHA1

      be7cdc0ad17e22c6d9dbe5c4943d9474d697b1f0

    • SHA256

      b175198523ec0ee22013b9c066fedbe7db317e776c31757e6dc3a0254004211e

    • SHA512

      ffc64f5925312e9075bb384c6e1f850cb9e5821e027d82bb1902da01583e760615fb6786b61ac9e49e3a789a9341a01c8b6d8ecff3b57a32ccb8c724e450748b

    Score
    10/10
    asyncratvenom clientsrat

    • AsyncRat

      AsyncRAT is designed to remotely monitor and control other computers written in C#.

      ratasyncrat

    • Async RAT payload

      rat

    • Blocklisted process makes network request

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    behavioral13behavioral14

    • Target

      zay/INVOICE#TBSAOKHBSA.cmd

    • Size

      111KB

    • MD5

      2c3351c659a42a82e3a3d865c88eaaaf

    • SHA1

      7c73b2c98e449be1c5a85806c08cfe05c0a699ab

    • SHA256

      f8f8f56ff4b52a36a6619ca8eadab3df1ae333dfda870a36b024bd74cf0ce9e4

    • SHA512

      b1962ca896f6328289a61522c6ede86bd0e6436d3dd6ca2170888ee2592a9cf88640f801dd864dbab1713ddb930b4dbed3cba0c5362f56f19150fcdabab599c6

    • SSDEEP

      3072:hXiSJ9Nvg6aGNGIR9Lb5ZQ6gvr+sBKWTP8ydL:hnXy2wg9f5ZezrKWTPdV

    Score
    10/10
    asyncratvenom clientsrat

    • AsyncRat

      AsyncRAT is designed to remotely monitor and control other computers written in C#.

      ratasyncrat

    • Async RAT payload

      rat

    • Blocklisted process makes network request

    behavioral15behavioral16

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

4
T1082

Query Registry

1
T1012

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Tasks