asyncrat | Cozios-Imagelogger-main[.]zip

General

Target
Cozios-Imagelogger-main.zip
Size 44KB
Sample240507-vl5wjsfe2x
SHA256 28754382a728e0d2a417e436fdd07b3989cff1a8457be25b298d91937a99d797
MD5 e61527ec1745146d86d037c10ce01e14
SHA1 c4c05ba1ae00fa59b0a8209fccff87fa6e0b40cf
SHA512 2ae962c00be4847f6d4b055babfc67f6cda9af6e38b001be2b6e915ad39d742a596f2484f2d21db88184b63994b463eca2705527872f91892bb6fd695c67aae4
SSDEEP 768:7ACGQ3eAUrGo+ANfh2tlElvMExnwpmoGJtVxz5BB2t5+ECTk95e:01fT6INfAtlEFMEImTnBB2thQ
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

rat default asyncrat

Malware Config

Extracted

Family

asyncrat

Version

Venom RAT + HVNC + Stealer + Grabber v6.0.3

Botnet

Default

Mutex

idjtweoowocnoy

Attributes

delay
1
install
true
install_file
Cozios Imagelogger.exe
install_folder
%AppData%
pastebin_config
https://pastebin.com/raw/LwwcrLg4

aes.plain

Signatures

Async RAT payload 1 IoCs

rat

resource	yara_rule
static1/unpack001/Cozios-Imagelogger-main/cozios ImageLogger.exe	family_asyncrat

Asyncrat family
asyncrat

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
unpack001/Cozios-Imagelogger-main/cozios ImageLogger.exe

File Explorer

Cozios-Imagelogger-main.zip

.zip 44KB
Cozios-Imagelogger-main/README.md

14B
Cozios-Imagelogger-main/cozios ImageLogger.exe

.exe 81KB

Cozios-Imagelogger-main.zip

SHA256 28754382a728e0d2a417e436fdd07b3989cff1a8457be25b298d91937a99d797
MD5 e61527ec1745146d86d037c10ce01e14
SHA1 c4c05ba1ae00fa59b0a8209fccff87fa6e0b40cf
SHA512 2ae962c00be4847f6d4b055babfc67f6cda9af6e38b001be2b6e915ad39d742a596f2484f2d21db88184b63994b463eca2705527872f91892bb6fd695c67aae4
SSDEEP 768:7ACGQ3eAUrGo+ANfh2tlElvMExnwpmoGJtVxz5BB2t5+ECTk95e:01fT6INfAtlEFMEImTnBB2thQ
MD5 SHA1 SHA512 SSDEEP

Cozios-Imagelogger-main/cozios ImageLogger.exe

IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
SHA256 498b02baa4dee1f19d4d06e45e5eda8bbf386fcce695f07846ac5374c654e406
MD5 23f472ba6e59df467b80af92f43eaf22
SHA1 7dd4433d3f059ea4a13454991f841c756aba3e47
SHA512 ecaa60619bc59a546a8100518d5866fc993ae2be340454e6b1ea6a9dc05efa33946198a0e798488659c99c959d937cc63e09ce746d254bcab8a12c233a088468
SSDEEP 1536:DUxwcx/BVuCkmPMVhAz0M4zyAkIQH1by/4XOp4QzcQ633I6VclN:DU+cx/Bw/mPMVhA1BH1byl4Ql633IIY
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Async RAT payload

rat
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

79038

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE

PDB paths

Cozios-Imagelogger-main.zip

Cozios-Imagelogger-main/README.md

Cozios-Imagelogger-main/cozios ImageLogger.exe

mscoree

dotnet

Sharing

General

Malware Config

Extracted

Signatures

File Explorer

Cozios-Imagelogger-main.zip

Cozios-Imagelogger-main/README.md

Cozios-Imagelogger-main/cozios ImageLogger.exe

mscoree

dotnet