Behavioral task
behavioral1
Sample
ClientX.exe
Resource
win7-20240220-en
General
-
Target
ClientX.exe
-
Size
73KB
-
MD5
9e645cc15574497571badd71c00381b2
-
SHA1
fc89ffef226890548b9ad4f28708ae1af74acc95
-
SHA256
97286457d8ab5c3d58a7ca6b81dbf9d3a96a1aa23691d1db1c9f5fb6edf859a5
-
SHA512
b3ac04f33376b26c91a16642d6e6378302617f58125b863911235f416b635375844d9ed93aa201d2fe7186a44efbfb6d26412e670020ce949a585c752e41703e
-
SSDEEP
1536:E5U1AcxqXPC/2PMVu1qievcVIXi1bv/FSLQzc33VclN:MUKcxqfs2PMV0qzxi1bvULQSlY
Malware Config
Extracted
asyncrat
Venom RAT + HVNC + Stealer + Grabber v6.0.3
Default
209.25.140.1:42550
-
delay
1
-
install
true
-
install_file
test.exe
-
install_folder
%AppData%
Signatures
-
Asyncrat family
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource ClientX.exe
Files
-
ClientX.exe.exe windows:4 windows x64 arch:x64
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Sections
.text Size: 69KB - Virtual size: 69KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 3KB - Virtual size: 3KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ