General
-
Target
https://github.com/VenomRATHVNC/VenomRAT-HVNC-5.6/releases/download/Compiled
-
Sample
240609-h6tb2agc36
Score
10/10
Malware Config
Extracted
Family
quasar
Version
1.4.0
Botnet
v15.4.1 | Venom
C2
dofucks.com:12482
private115.duckdns.org:12482
Mutex
adf10731-c83d-4166-9137-39d0b1e48856
Attributes
-
encryption_key
C84CB6134701741C5122A14FACDB67C8CFA9C0AB
-
install_name
.exe
-
log_directory
$sxr-Logs
-
reconnect_delay
3000
-
startup_key
$sxr-seroxen
Extracted
Family
asyncrat
Version
5.0.5
Botnet
Venom Clients
C2
127.0.0.1:4449
Mutex
Venom_RAT_HVNC_Mutex_Venom RAT_HVNC
Attributes
-
delay
1
-
install
false
-
install_folder
%AppData%
aes.plain
Targets
-
-
Target
https://github.com/VenomRATHVNC/VenomRAT-HVNC-5.6/releases/download/Compiled
Score10/10-
AsyncRat
AsyncRAT is designed to remotely monitor and control other computers written in C#.
-
Quasar RAT
Quasar is an open source Remote Access Tool.
-
Quasar payload
-
Suspicious use of NtCreateUserProcessOtherParentProcess
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE
-
Loads dropped DLL
-
Legitimate hosting services abused for malware hosting/C2
-
Drops file in System32 directory
-
Suspicious use of SetThreadContext
-