Overview

overview

10

Static

static

10

runtime.exe

windows7-x64

10

runtime.exe

windows10-2004-x64

10

win5.exe

windows7-x64

7

win5.exe

windows10-2004-x64

7

Sharing

Copy URL
Twitter E-mail

General

  • Target

    win5i.zip

  • Size

    13.6MB

  • MD5

    cbd5231b3d8bd511ab28c10b0082c126

  • SHA1

    f9764513b8fef61561fbfae0a2c575190bbf136c

  • SHA256

    8a6f75426c02db73affeb070b56bebcbfb8769387dfc15f94018ffc1f63d3938

  • SHA512

    8485b591db278395b143d7c2e1bacb177ec67117e779b6065513e9ec714c2d3eeefebeb3b3afcbd6221df3a949afe790e25956f89a3d7431041ab169d32a39cb

  • SSDEEP

    196608:VfE7Wp1+IZGzaIWCTWOynhtcLNtFC3Azdxg/rXI+TleGqSYNEa7bNL8nXGIFf743:a7frJynHcnswWdPoXfaXT7IfW+

Score
10/10
ratdefaultpyinstallerasyncrat

Malware Config

Extracted

Family

asyncrat

Version

Venom RAT + HVNC + Stealer + Grabber v6.0.2

Botnet

Default

C2

72.5.43.15:4449

Mutex

yezcydjwbxouz

Attributes
  • delay

    1

  • install

    true

  • install_file

    win.exe

  • install_folder

    %AppData%

aes.plain

Signatures

  • Async RAT payload 1 IoCs
    rat
  • Asyncrat family
    asyncrat
  • Detects Pyinstaller 1 IoCs
    pyinstaller
  • Unsigned PE 2 IoCs

    Checks for missing Authenticode signature.

Files

  • win5i.zip
    .zip
  • runtime.exe
    .exe windows:4 windows x86 arch:x86

    f34d5f2d4577ed6d9ceec516c1f5a744


    Headers

    Imports

    Sections

  • win5.exe
    .exe windows:5 windows x64 arch:x64

    0b5552dccd9d0a834cea55c0c8fc05be


    Headers

    Imports

    Sections

  • main.pyc