asyncrat | C11Bootstrapper[.]zip

Sharing

Copy URL Twitter E-mail

General

Target
C11Bootstrapper.zip
Size 214KB
Sample240419-za94caeg77
SHA256 60250d1395011fa3fafae608a46d70882fc4e1ad13b7146eed27d49344edb554
MD5 554a6628d2a45997875764e432152e6e
SHA1 2ffcfba2654c6c6e3ffe267da5dd47e661cfdb5c
SHA512 f028158395ec4b648665fa200089d9005f539bd6dcf95946bb08d2a20dae0c731a24ac738f76777a4df24943ded0b12652988904df2010f892b2308d9834e766
SSDEEP 6144:iA3cXkEnu8vjKbnU9tWCnHGXf3fgDmacEA48fHJk:iAMXkr8IUjmXfPgDmacEA4gpk
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

rat default asyncrat umbral

Malware Config

Extracted

Family

asyncrat

Version

Venom RAT + HVNC + Stealer + Grabber v6.0.3

Botnet

Default

127.0.0.1:4449
127.0.0.1:6555
127.0.0.1:0
127.0.0.1:4040

Mutex

chhphkahmfnasuyziqc

Attributes

delay
1
install
false
install_folder
%Temp%

aes.plain

Extracted

Family

umbral

https://discord.com/api/webhooks/1210158511317590106/v9w3kiFGxTmHnaLb091GZCxjv8fdr5efj0qIDNAgPdpreNR5UKL8WQl7YxoqctUCkOnB

Signatures

Async RAT payload 2 IoCs

rat

resource	yara_rule
static1/unpack001/C11Bootstrapper/Properties/C11Setup.exe	family_asyncrat
static1/unpack001/C11Bootstrapper/Properties/PageEditor.exe	family_asyncrat

Asyncrat family
asyncrat

Detect Umbral payload 1 IoCs

resource	yara_rule
static1/unpack001/C11Bootstrapper/Properties/GuiLoader.exe	family_umbral

Umbral family
umbral

Unsigned PE 3 IoCs

Checks for missing Authenticode signature.

resource
unpack001/C11Bootstrapper/Properties/C11Setup.exe
unpack001/C11Bootstrapper/Properties/GuiLoader.exe
unpack001/C11Bootstrapper/Properties/PageEditor.exe

File Explorer

C11Bootstrapper.zip

.zip 214KB
C11Bootstrapper/Properties/C11Setup.exe

.exe 252KB
C11Bootstrapper/Properties/GuiLoader.exe

.exe 246KB
C11Bootstrapper/Properties/IndependenciesInstallation.bat

489B
C11Bootstrapper/Properties/PageEditor.exe

.exe 74KB
C11Bootstrapper/Properties/msgbox.vbs

96B
C11Bootstrapper/Readme.txt

262B
C11Bootstrapper/Start.bat

1KB

C11Bootstrapper.zip

SHA256 60250d1395011fa3fafae608a46d70882fc4e1ad13b7146eed27d49344edb554
MD5 554a6628d2a45997875764e432152e6e
SHA1 2ffcfba2654c6c6e3ffe267da5dd47e661cfdb5c
SHA512 f028158395ec4b648665fa200089d9005f539bd6dcf95946bb08d2a20dae0c731a24ac738f76777a4df24943ded0b12652988904df2010f892b2308d9834e766
SSDEEP 6144:iA3cXkEnu8vjKbnU9tWCnHGXf3fgDmacEA48fHJk:iAMXkr8IUjmXfPgDmacEA4gpk
MD5 SHA1 SHA512 SSDEEP

C11Bootstrapper/Properties/C11Setup.exe

IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
SHA256 b57490326cb83aaf68d2ddfd95655b89387956100c5d09c8fcd4fa50e54fb5c4
MD5 c23a7c501e475f0065efdc9775890deb
SHA1 adc0d1bb12657bd6ca4354399cbfab7b9ad9cd45
SHA512 f6374e254a5ccad62549b235b4c66ef6164cfc34fd91d9ca545d44dce87c3d78984759e858d5eae796f8a096f91cf3fe5f0e1255660b00b1ece430e82af539c7
SSDEEP 3072:yURcxONo2PMVI+DdH1bsv8eOQbR7c2ytBcL5BdkwvTkmEdxkY:yEo2PMVPdVbSOkWwvqdK
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Async RAT payload

rat
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

78942

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE

PDB paths

C11Bootstrapper/Properties/GuiLoader.exe

IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
SHA256 f61483bd59316dff21d5bc3fc8f32811dd8ddca826a84255ab5ea2cdfef3d7ae
MD5 1bb249792e56063762f5adb2d94fc8c9
SHA1 9a1fa4886ed023f864c06345b639a121f6359cd1
SHA512 d8a2af35713bf4ce979440375c460b9f7b3f2849abc9cdf0d2fdb5e891a5bab36ed101da94f6b57d3dc775c3a0fdeffbaeab8981965ec72fe56adfa5dab501ba
SSDEEP 6144:RloZM+rIkd8g+EtXHkv/iD4kgOZGCg/7I7R0STTKvYb8e1mZzi:joZtL+EP8kgOZGCg/7I7R0STTKIX
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Detect Umbral payload
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

240270

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_32BIT_MACHINE

PDB paths

C11Bootstrapper/Properties/PageEditor.exe

IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
SHA256 27f935d3417a40c871572f8bdfe5168b8caa1dc603dd6d4cf466d2a943a73083
MD5 442510aa0ce41f62d8c30c76a1d1f96f
SHA1 9d5dec9eba0d5d32750b9c891ce4697893883a1e
SHA512 25f20691094c9c0d5fd868a04451039407c442d05e8c43659465fe36d24ba618d1912296f57ce3ae64a168e03809716c2d95376a90acf561c12035254efb2d62
SSDEEP 1536:jU9kcx5v/5CxSPMV7jCBevPIaH1b8/vuytQzc51VclN:jU2cx5vx2SPMV3CCrH1b83uAQsXY
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Async RAT payload

rat
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

79006

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE

PDB paths

C11Bootstrapper.zip

C11Bootstrapper/Properties/C11Setup.exe

mscoree

dotnet

C11Bootstrapper/Properties/GuiLoader.exe

mscoree

dotnet

C11Bootstrapper/Properties/IndependenciesInstallation.bat

C11Bootstrapper/Properties/PageEditor.exe

mscoree

dotnet

C11Bootstrapper/Properties/msgbox.vbs

C11Bootstrapper/Readme.txt

C11Bootstrapper/Start.bat