Overview

overview

10

Static

static

1

pw.ps1

windows7-x64

1

pw.ps1

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    pw.ps1

  • Size

    13.0MB

  • Sample

    240426-xjrl9ahh93

  • MD5

    50eb02e67256948eb696df9762a46422

  • SHA1

    2494e4466131091bf71caf26ff1aadf986e0acbc

  • SHA256

    1b5cd42f4382ba1f47f3b6b4dd3e0cdf707eaf6a25494114126242f202b9f5cd

  • SHA512

    e13e93e494631fa361f41ad13ed31d47bb20e3a03e5898fb39738508b943c0f8c5537c8c41b9cdbd522cdce997b3935abcf9ae972f0886283973ceab2ebc2d08

  • SSDEEP

    49152:q+PeksaLvwswXlcCdoFcoc9EjBomkb6ri5yRb:

Score
10/10
asyncratvenom clientsrat

Malware Config

Extracted

Family

asyncrat

Version

5.0.5

Botnet

Venom Clients

C2

undjsj.duckdns.org:8890

Mutex

Venom_RAT_HVNC_Mutex_Venom RAT_HVNC

Attributes
  • delay

    1

  • install

    false

  • install_folder

    %AppData%

aes.plain

Targets

    • Target

      pw.ps1

    • Size

      13.0MB

    • MD5

      50eb02e67256948eb696df9762a46422

    • SHA1

      2494e4466131091bf71caf26ff1aadf986e0acbc

    • SHA256

      1b5cd42f4382ba1f47f3b6b4dd3e0cdf707eaf6a25494114126242f202b9f5cd

    • SHA512

      e13e93e494631fa361f41ad13ed31d47bb20e3a03e5898fb39738508b943c0f8c5537c8c41b9cdbd522cdce997b3935abcf9ae972f0886283973ceab2ebc2d08

    • SSDEEP

      49152:q+PeksaLvwswXlcCdoFcoc9EjBomkb6ri5yRb:

    Score
    10/10
    asyncratvenom clientsrat

    • AsyncRat

      AsyncRAT is designed to remotely monitor and control other computers written in C#.

      ratasyncrat

    • Suspicious use of NtCreateUserProcessOtherParentProcess

    • Async RAT payload

      rat
    behavioral1behavioral2

MITRE ATT&CK Matrix

Tasks