Overview

overview

10

Static

static

10

VenomRAT v...er.exe

windows7-x64

10

VenomRAT v...er.exe

windows10-2004-x64

10

Resubmissions

01/07/2024, 13:38

240701-qxfctavbjd

01/07/2024, 13:36

240701-qwkk5sxhmp

01/07/2024, 13:34

240701-qt62csxgqn

15/04/2024, 16:24

240415-twdpdaag85

15/04/2024, 16:06

240415-tj8zracg31

15/04/2024, 15:53

240415-tbwpfsce4y10

23/03/2024, 00:57

240323-ba892sbc5610

Sharing

Copy URL Twitter E-mail

General

  • Target
    35dd1e24b5d7024c28d728aa28146f910c0b9832b5dff75ce5e972b5a6f414c5
  • Size 89.0MB
  • Sample240415-twdpdaag85
  • SHA256 35dd1e24b5d7024c28d728aa28146f910c0b9832b5dff75ce5e972b5a6f414c5
  • MD5 SHA1 SHA512 SSDEEP
Score
10/10
asyncratquasarstormkittydefaultv3.0.0 | venomdefense_evasionexecutionratspywaretrojan

Malware Config

Extracted

Family

  • asyncrat

Version

  • 1.0.7

Botnet

  • Default

C2

  • 95.216.52.21:7575

Mutex

  • xdnqiaxygefjfoolgo

Attributes
  • delay

    1

  • install

    false

  • install_folder

    %AppData%

aes.plain

Extracted

Family

  • quasar

Version

  • 1.0.0.0

Botnet

  • v3.0.0 | Venom

C2

  • 134.255.254.225:5050

  • buy-positioning.at.ply.gg:58563

  • buy-positioning.at.ply.gg:5050

Mutex

  • 90bea261-2bc5-4336-a086-718cd0ea9335

Attributes
  • encryption_key

    4A61C133F5AD65F90240BF44872C676E824A6CA7

  • install_name

    .exe

  • log_directory

    $sxr-Logs

  • reconnect_delay

    1000

Targets

    • Target
      VenomRAT v6.0.3/Venom RAT + HVNC + Stealer + Grabber.exe
    • Size 26.1MB
    • SHA256 5dbb0f9df5fc34b49f0e284afe9037206c29dd8e50f0adbbcca785dcca89592e
    • MD5 SHA1 SHA512 SSDEEP
    Score
    10/10
    asyncratexecutionratquasarv3.0.0 | venomdefense_evasionspywaretrojan

    • AsyncRat

      AsyncRAT is designed to remotely monitor and control other computers written in C#.

      ratasyncrat

    • Quasar RAT

      Quasar is an open source Remote Access Tool.

      trojanspywarequasar

    • Quasar payload

    • Command and Scripting Interpreter: PowerShell

      Run Powershell and hide display window.

      execution

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Impair Defenses: Safe Mode Boot

      defense_evasion

    • Hide Artifacts: Hidden Window

      Windows that would typically be displayed when an application carries out an operation can be hidden.

      defense_evasion

    • Drops file in System32 directory

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks