Overview

overview

10

Static

static

10

Client.exe

windows10-1703-x64

10

Client.exe

windows10-2004-x64

10

Client.exe

windows11-21h2-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    Client.exe

  • Size

    63KB

  • Sample

    240524-x5frwagc6w

  • MD5

    68a978592c6c5cc22da0b7dde87b2d44

  • SHA1

    a0d7dd10bb29f769b68d6e7333dda1913b049250

  • SHA256

    e13360fe12492ad8b6f72d8cbd0969cfab0003e9898d13afe1c5de7bbb143b1f

  • SHA512

    b2a9963d7ddf8047a74d71aec720df1c3edec0dd0d17b7e6734addbe57b324bce103b322fdc174da979586f83856a75dc489d240e29114ff09d4ed50647054e5

  • SSDEEP

    1536:QhB5LrUwk4XO01V5eeiIVrGbbXwUNeGODpqKmY7:QhB5LrUwk4XVVseXGbbX/NQgz

Score
10/10
asyncratclientevasionrat

Malware Config

Extracted

Family

asyncrat

Version

5.0.5

Botnet

Client

C2

uk2.localto.net:3793

Mutex

Venom_RAT_HVNC_Mutex_Venom RAT_HVNC

Attributes
  • delay

    1

  • install

    false

  • install_folder

    %AppData%

aes.plain

Targets

    • Target

      Client.exe

    • Size

      63KB

    • MD5

      68a978592c6c5cc22da0b7dde87b2d44

    • SHA1

      a0d7dd10bb29f769b68d6e7333dda1913b049250

    • SHA256

      e13360fe12492ad8b6f72d8cbd0969cfab0003e9898d13afe1c5de7bbb143b1f

    • SHA512

      b2a9963d7ddf8047a74d71aec720df1c3edec0dd0d17b7e6734addbe57b324bce103b322fdc174da979586f83856a75dc489d240e29114ff09d4ed50647054e5

    • SSDEEP

      1536:QhB5LrUwk4XO01V5eeiIVrGbbXwUNeGODpqKmY7:QhB5LrUwk4XVVseXGbbX/NQgz

    Score
    10/10
    asyncratclientratevasion

    • AsyncRat

      AsyncRAT is designed to remotely monitor and control other computers written in C#.

      ratasyncrat

    • Grants admin privileges

      Uses net.exe to modify the user's privileges.

    • Modifies Windows Firewall

      evasion
    behavioral1behavioral2behavioral3

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Command and Scripting Interpreter

1
T1059

Persistence

Account Manipulation

1
T1098

Create or Modify System Process

1
T1543

Windows Service

1
T1543.003

Privilege Escalation

Create or Modify System Process

1
T1543

Windows Service

1
T1543.003

Defense Evasion

Impair Defenses

1
T1562

Disable or Modify System Firewall

1
T1562.004

Credential Access

Discovery

Process Discovery

1
T1057

System Information Discovery

2
T1082

Lateral Movement

Collection

Data from Local System

1
T1005

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Tasks