Overview

overview

10

Static

static

1

download.vbs

windows7-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    download.vbs

  • Size

    897KB

  • Sample

    240524-b3ldpagh44

  • MD5

    c983e816294b2d4c2213db5bc4339393

  • SHA1

    4eb96d15af10865ac93ed29ec475bb8eafe91ea3

  • SHA256

    255c4ecba922d8b56534bd7a571525c67eb39bbef0f18bc96e414160a95fc2f6

  • SHA512

    fac24fd9947e732069c7a3fdcb91376ace629ace66b1e0f9fb384b9ca03725c7f39b8f817c4bea4593595f30ebb67083fbafaebe61bfc59a3176caddf3aeaecb

  • SSDEEP

    12288:qzTzUyR7hSRac+qkLmttaGgMskgqoiMHsp90:UXh+k+taGKqoJO0

Score
10/10
asyncratvenom clientsrat

Malware Config

Extracted

Family

asyncrat

Version

5.0.5

Botnet

Venom Clients

C2

xvern429.duckdns.org:8890

Mutex

Venom_RAT_HVNC_Mutex_Venom RAT_HVNC

Attributes
  • delay

    1

  • install

    false

  • install_folder

    %AppData%

aes.plain

Targets

    • Target

      download.vbs

    • Size

      897KB

    • MD5

      c983e816294b2d4c2213db5bc4339393

    • SHA1

      4eb96d15af10865ac93ed29ec475bb8eafe91ea3

    • SHA256

      255c4ecba922d8b56534bd7a571525c67eb39bbef0f18bc96e414160a95fc2f6

    • SHA512

      fac24fd9947e732069c7a3fdcb91376ace629ace66b1e0f9fb384b9ca03725c7f39b8f817c4bea4593595f30ebb67083fbafaebe61bfc59a3176caddf3aeaecb

    • SSDEEP

      12288:qzTzUyR7hSRac+qkLmttaGgMskgqoiMHsp90:UXh+k+taGKqoJO0

    Score
    10/10
    asyncratvenom clientsrat

    • AsyncRat

      AsyncRAT is designed to remotely monitor and control other computers written in C#.

      ratasyncrat

    • Blocklisted process makes network request

    • Suspicious use of NtCreateThreadExHideFromDebugger

    • Suspicious use of NtSetInformationThreadHideFromDebugger

    • Suspicious use of SetThreadContext

    behavioral1

MITRE ATT&CK Enterprise v15

Tasks