Overview

overview

10

Static

static

10

win7/runtime.exe

windows7-x64

10

win7/runtime.exe

windows10-2004-x64

10

win7/win5.exe

windows7-x64

7

win7/win5.exe

windows10-2004-x64

7

win7/win6.exe

windows7-x64

7

win7/win6.exe

windows10-2004-x64

7

Sharing

Copy URL Twitter E-mail

General

  • Target

    08b0e2870a7fc2dcd71879d84ff235b6f3b27ed5fa2d320a03821d55ce6d6726.zip

  • Size

    22.0MB

  • MD5

    78c12e107561655fed35af72ed4c7400

  • SHA1

    3668f3cb356f7ddee4e913df652542814531cd89

  • SHA256

    08b0e2870a7fc2dcd71879d84ff235b6f3b27ed5fa2d320a03821d55ce6d6726

  • SHA512

    1a32bf0df0e632509db83b7bcc85bb17aafd55adf6f40dcfc6418a3129aa47d7c1ca6783eecb65704ad392a14a666c5a1501635eb6305c88d6b8adba9458ff64

  • SSDEEP

    393216:O59jOFPfpmDOsL5NlALjjdx+pbd/O8hGDoGFLjsflmtsVeRnNZ:OjOFPBxG53QjpxKG8jGdUstser

Score
10/10
ratdefaultpyinstallerasyncrat

Malware Config

Extracted

Family

asyncrat

Version

Venom RAT + HVNC + Stealer + Grabber v6.0.2

Botnet

Default

C2

72.5.43.15:4449

Mutex

yezcydjwbxouz

Attributes
  • delay

    1

  • install

    true

  • install_file

    win.exe

  • install_folder

    %AppData%

aes.plain

Signatures

  • Async RAT payload 1 IoCs
    rat
  • Asyncrat family
    asyncrat
  • Detects Pyinstaller 1 IoCs
    pyinstaller
  • Unsigned PE 3 IoCs

    Checks for missing Authenticode signature.

Files

  • 08b0e2870a7fc2dcd71879d84ff235b6f3b27ed5fa2d320a03821d55ce6d6726.zip
    .zip
  • __MACOSX/._win7
  • __MACOSX/win7/._runtime.exe
  • __MACOSX/win7/._win5.exe
  • __MACOSX/win7/._win6.exe
  • win7/runtime.exe
    .exe windows:4 windows x86 arch:x86

    f34d5f2d4577ed6d9ceec516c1f5a744


    Headers

    Imports

    Sections

  • win7/win5.exe
    .exe windows:5 windows x64 arch:x64

    0b5552dccd9d0a834cea55c0c8fc05be


    Headers

    Imports

    Sections

  • main.pyc
  • win7/win6.exe
    .exe windows:4 windows x64 arch:x64

    e44f44f1060dd800fd861c4e5ad59e21


    Headers

    Imports

    Sections