General

  • Target

    Shiba Gold cracked.exe

  • Size

    63KB

  • Sample

    240327-enz53sfd3v

  • MD5

    d26096bfa7a572735428a81777b98c68

  • SHA1

    ee2285b122ba6e0f33eabc0b3f737a46afbbce21

  • SHA256

    85e36fc4d5197ba67542c9391d33a3768f1c772d023a774b833b88ff5f07e8d5

  • SHA512

    92e13b52a33b046faa80bd425d046e49e0ce842694e5407c8e9aee6d8ddb2bf68ec0c901bd5e9d7d31481bbb51ccefdb89f7861ccf7dc795896a323085e299ab

  • SSDEEP

    1536:YZeNjfU/cNRPZNg/pl1R4yIcbbMwOQ3eRGiDpqKmY7:YZeNjfU/clCpqHcbbMBgz

Malware Config

Extracted

Family

asyncrat

Version

5.0.5

Botnet

Venom Clients

C2

192.168.1.26:4449

Mutex

Venom_RAT_HVNC_Mutex_Venom RAT_HVNC

Attributes
  • delay

    1

  • install

    true

  • install_file

    Win-setup.exe

  • install_folder

    %AppData%

aes.plain

Targets

    • Target

      Shiba Gold cracked.exe

    • Size

      63KB

    • MD5

      d26096bfa7a572735428a81777b98c68

    • SHA1

      ee2285b122ba6e0f33eabc0b3f737a46afbbce21

    • SHA256

      85e36fc4d5197ba67542c9391d33a3768f1c772d023a774b833b88ff5f07e8d5

    • SHA512

      92e13b52a33b046faa80bd425d046e49e0ce842694e5407c8e9aee6d8ddb2bf68ec0c901bd5e9d7d31481bbb51ccefdb89f7861ccf7dc795896a323085e299ab

    • SSDEEP

      1536:YZeNjfU/cNRPZNg/pl1R4yIcbbMwOQ3eRGiDpqKmY7:YZeNjfU/clCpqHcbbMBgz

    • AsyncRat

      AsyncRAT is designed to remotely monitor and control other computers written in C#.

    • Async RAT payload

    • Executes dropped EXE

MITRE ATT&CK Matrix ATT&CK v13

Execution

Scheduled Task/Job

1
T1053

Persistence

Scheduled Task/Job

1
T1053

Privilege Escalation

Scheduled Task/Job

1
T1053

Discovery

System Information Discovery

1
T1082

Query Registry

1
T1012

Tasks