General

  • Target

    255569d7156794ac033567269a847e93acdfc95126dbad54af5b8909bba4c553

  • Size

    74KB

  • Sample

    240530-ymp39sgh5w

  • MD5

    c9e368cb65ed6c541e29b52aeb4c2af4

  • SHA1

    b2fe42b7ee53d11cc6cac3e6a99a92f72ff9cc01

  • SHA256

    255569d7156794ac033567269a847e93acdfc95126dbad54af5b8909bba4c553

  • SHA512

    10ad380013e2efa9f85110e97ebb1187c22fadc2b43f6633af65aedb3b9ffc0355695a70858eef8a6d819423778552f17ebaeeb19ba3b521da2584a9f1e74b81

  • SSDEEP

    1536:2UvNwcxKHXwzCtmPMV2e9VdQuDI6H1bf/OSQzcqLVclN:2UvicxK8WmPMV2e9VdQsH1bffQbBY

Score
10/10

Malware Config

Extracted

Family

asyncrat

Version

Venom RAT + HVNC + Stealer + Grabber v6.0.3

Botnet

Default

C2

147.185.221.19:38173

Mutex

uuhaiushdishajkdhwuasudh

Attributes
  • delay

    1

  • install

    true

  • install_file

    svhost.exe

  • install_folder

    %AppData%

aes.plain

Targets

    • Target

      255569d7156794ac033567269a847e93acdfc95126dbad54af5b8909bba4c553

    • Size

      74KB

    • MD5

      c9e368cb65ed6c541e29b52aeb4c2af4

    • SHA1

      b2fe42b7ee53d11cc6cac3e6a99a92f72ff9cc01

    • SHA256

      255569d7156794ac033567269a847e93acdfc95126dbad54af5b8909bba4c553

    • SHA512

      10ad380013e2efa9f85110e97ebb1187c22fadc2b43f6633af65aedb3b9ffc0355695a70858eef8a6d819423778552f17ebaeeb19ba3b521da2584a9f1e74b81

    • SSDEEP

      1536:2UvNwcxKHXwzCtmPMV2e9VdQuDI6H1bf/OSQzcqLVclN:2UvicxK8WmPMV2e9VdQsH1bffQbBY

    Score
    10/10
    • AsyncRat

      AsyncRAT is designed to remotely monitor and control other computers written in C#.

    • Async RAT payload

    • Detects executables attemping to enumerate video devices using WMI

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

MITRE ATT&CK Matrix ATT&CK v13

Execution

Scheduled Task/Job

1
T1053

Persistence

Scheduled Task/Job

1
T1053

Privilege Escalation

Scheduled Task/Job

1
T1053

Discovery

Query Registry

2
T1012

System Information Discovery

2
T1082

Tasks