Behavioral task
behavioral1
Sample
sclient.exe
Resource
win7-20240221-en
General
-
Target
sclient.exe
-
Size
74KB
-
MD5
e74473ce3c543742f9c9af0f50110394
-
SHA1
267f50cbc58047fd7eb3c7e8b7cd9578da3969de
-
SHA256
b79f88a2b7ba116fa4c0a2565d373db22bbbb312be647c352860b015927c6ec8
-
SHA512
705fe63d572521b17bb68af179ebd1af989dcbd924e9dd3e057c035992607e7a07faa8c06d35da48efb9b4f93b42e2acff4f7af36e2be2d9e5cd5905cf3b9580
-
SSDEEP
1536:hURAcxoXhCL2PMVn/PJGTIuH1bp/j4/QzcYxLVclN:hU+cxoxo2PMV3EH1bpk/QNxBY
Malware Config
Extracted
asyncrat
Venom RAT + HVNC + Stealer + Grabber v6.0.3
Default
drlwrqqffwoynptzb
-
delay
1
-
install
true
-
install_file
system32.exe
-
install_folder
%AppData%
-
pastebin_config
https://pastebin.com/raw/095APLHG
Signatures
Files
-
sclient.exe.exe windows:4 windows x86 arch:x86
f34d5f2d4577ed6d9ceec516c1f5a744
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
Imports
mscoree
_CorExeMain
Sections
.text Size: 69KB - Virtual size: 69KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 3KB - Virtual size: 3KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ