78c12e107561655fed35af72ed4c7400.bin
- SHA256 6c793eaf5b5b700aeed6cad66aa3bff7499bf8b1815cf09d5a39e2403da5dbfd
Password
infected
Behavioral task
behavioral1
Sample
win7/runtime.exe
Resource
win7-20231129-en
windows7-x64
11 signatures
150 seconds
Behavioral task
behavioral2
Sample
win7/runtime.exe
Resource
win10v2004-20240611-en
windows10-2004-x64
13 signatures
150 seconds
Behavioral task
behavioral3
Sample
win7/win5.exe
Resource
win7-20240221-en
windows7-x64
3 signatures
150 seconds
Behavioral task
behavioral4
Sample
win7/win5.exe
Resource
win10v2004-20240508-en
windows10-2004-x64
8 signatures
150 seconds
Behavioral task
behavioral5
Sample
win7/win6.exe
Resource
win7-20240220-en
windows7-x64
4 signatures
150 seconds
Behavioral task
behavioral6
Sample
win7/win6.exe
Resource
win10v2004-20240611-en
windows10-2004-x64
13 signatures
150 seconds
General
- Target 78c12e107561655fed35af72ed4c7400.bin
- Size 22.0MB
- Sample240620-dzx97a1ann
- SHA256 6c793eaf5b5b700aeed6cad66aa3bff7499bf8b1815cf09d5a39e2403da5dbfd
- MD5 db4ce6e3aeb6d6a05acf51cee9e272c2
- SHA1 eec142f9b15f7fd33c6d2963c01bdfc59e21c451
- SHA512 ef710e27858cc7116c25f796becd63483fff6afe7846f6ed109a1ade80d937510c299b9e4df7e2aad813a901a3169a84b5993c9ad2b1b09ef82d71867e58f2da
- SSDEEP 393216:cIqXL+PhiobrQWZ7oJZrV18/n2su9s4bOlhgFRDu/TU/H9PyKUDlk40DgVQaskoe:cIqXyEobJuJ8/nichmRITU/HJyL0pQoe
- MD5 SHA1 SHA512 SSDEEP
Score
10/10
Malware Config
Extracted
Family
-
asyncrat
Version
-
Venom RAT + HVNC + Stealer + Grabber v6.0.2
Botnet
-
Default
C2
-
72.5.43.15:4449
Mutex
-
yezcydjwbxouz
Attributes
-
delay
1
-
install
true
-
install_file
win.exe
-
install_folder
%AppData%
aes.plain
Signatures
- Async RAT payload 1 IoCs
resource yara_rule static1/unpack002/win7/runtime.exe family_asyncrat - Asyncrat family
- Detects Pyinstaller 1 IoCs
resource yara_rule static1/unpack002/win7/win5.exe pyinstaller - Unsigned PE 3 IoCs
Checks for missing Authenticode signature.
resource unpack002/win7/runtime.exe unpack002/win7/win5.exe unpack002/win7/win6.exe
File Explorer
-
78c12e107561655fed35af72ed4c7400.bin.zip 22.0MB
-
08b0e2870a7fc2dcd71879d84ff235b6f3b27ed5fa2d320a03821d55ce6d6726.zip.zip 22.0MB
-
__MACOSX/._win7212B
-
__MACOSX/win7/._runtime.exe212B
-
__MACOSX/win7/._win5.exe212B
-
__MACOSX/win7/._win6.exe212B
-
win7/runtime.exe.exe 73KB
-
win7/win5.exe.exe 13.8MB
-
main.pyc16KB
-
win7/win6.exe.exe 8.5MB
08b0e2870a7fc2dcd71879d84ff235b6f3b27ed5fa2d320a03821d55ce6d6726.zip
- SHA256 08b0e2870a7fc2dcd71879d84ff235b6f3b27ed5fa2d320a03821d55ce6d6726
- MD5 78c12e107561655fed35af72ed4c7400
- SHA1 3668f3cb356f7ddee4e913df652542814531cd89
- SHA512 1a32bf0df0e632509db83b7bcc85bb17aafd55adf6f40dcfc6418a3129aa47d7c1ca6783eecb65704ad392a14a666c5a1501635eb6305c88d6b8adba9458ff64
- SSDEEP 393216:O59jOFPfpmDOsL5NlALjjdx+pbd/O8hGDoGFLjsflmtsVeRnNZ:OjOFPBxG53QjpxKG8jGdUstser
- MD5 SHA1 SHA512 SSDEEP
Password
infected
__MACOSX/._win7
- SHA256 5c6e306d73f2d96700485d5583523fcee252c34b977d2ca69c2ca390e21aa87e
- MD5 1c4a9a52f28c345405414e41072b096e
- SHA1 f9eaa4205dca4d53bad4624bf7e6a7aaa5327749
- SHA512 4d745854fd47b698213dd967cd3face72598d171eaf88e0af3c3368bb92d843c230d98c231bf9db03cda485a29ea62eb1a5ea9c416109ec3b0ff0db819cedd41
- MD5 SHA1 SHA512
__MACOSX/win7/._runtime.exe
- SHA256 5c6e306d73f2d96700485d5583523fcee252c34b977d2ca69c2ca390e21aa87e
- MD5 1c4a9a52f28c345405414e41072b096e
- SHA1 f9eaa4205dca4d53bad4624bf7e6a7aaa5327749
- SHA512 4d745854fd47b698213dd967cd3face72598d171eaf88e0af3c3368bb92d843c230d98c231bf9db03cda485a29ea62eb1a5ea9c416109ec3b0ff0db819cedd41
- MD5 SHA1 SHA512
__MACOSX/win7/._win5.exe
- SHA256 5c6e306d73f2d96700485d5583523fcee252c34b977d2ca69c2ca390e21aa87e
- MD5 1c4a9a52f28c345405414e41072b096e
- SHA1 f9eaa4205dca4d53bad4624bf7e6a7aaa5327749
- SHA512 4d745854fd47b698213dd967cd3face72598d171eaf88e0af3c3368bb92d843c230d98c231bf9db03cda485a29ea62eb1a5ea9c416109ec3b0ff0db819cedd41
- MD5 SHA1 SHA512
__MACOSX/win7/._win6.exe
- SHA256 5c6e306d73f2d96700485d5583523fcee252c34b977d2ca69c2ca390e21aa87e
- MD5 1c4a9a52f28c345405414e41072b096e
- SHA1 f9eaa4205dca4d53bad4624bf7e6a7aaa5327749
- SHA512 4d745854fd47b698213dd967cd3face72598d171eaf88e0af3c3368bb92d843c230d98c231bf9db03cda485a29ea62eb1a5ea9c416109ec3b0ff0db819cedd41
- MD5 SHA1 SHA512
win7/runtime.exe
- IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
- SHA256 5f5aa560b9b2d9f7ea3b9a4e05b9b9b35107dc78bd763000fe05f6b3f998f311
- MD5 4fa7b1eec1fc84eb3a13c29e5a37aae7
- SHA1 dfff9fceeb4d74d7e82f9f0a65d1889fa0f9e326
- SHA512 5e36a5589499a3db56d78de1b66a9ee57a2972bc57bf4b915df9118fd2a584c74ba00c61531d922431b72e87f9c53585c4c1a78a2aba122a22ea5e3603aa06ba
- SSDEEP 1536:KIUme0cxdlOH4PAI7Bn3h36rAi8EjZUPMwC/eqmmRhdWVH1bfbfPmjmwzUYbVclN:KIUm3cxdlOH4YI7Bn3h36rAi8EVUPMwv
- MD5 SHA1 SHA512 SSDEEP
-
Async RAT payload
-
Unsigned PE
Checks for missing Authenticode signature.
Password
infected
Minor OS version
0
Major OS version
4
Entry point
78766
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
PDB paths
mscoree
_CorExeMain
Name
.text
Size
69KB
Virtual Size
68KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
3KB
Virtual Size
3KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
win7/win5.exe
- IMPHASH 0b5552dccd9d0a834cea55c0c8fc05be
- SHA256 d8bbee1d3eee12b9d710cc892d767469578a511a8149ada07a05dfbee89941bf
- MD5 2639068bf1e1de3ccae340e6bee3e548
- SHA1 3eec25d70e72e94085b854a07af032d3e4df7c70
- SHA512 45ada1b47ab66e2c5f9e9344fd0d2e3b759a738ff4a970138ab8253dd12c55d7fe9cce5a9c3bb23c9c52a7d6d46ff6a0f86381d64bfd19ae8b1b1f222040cb6f
- SSDEEP 196608:ugFgX7miZ0sKYu/PaQqtG7fpDOjmFpMRxtYSHdKiy4kdai7bN3mDRI1p+CbbPlaJ:LFDQQYGVKKSphMB3Q1sDVaJ
- MD5 SHA1 SHA512 SSDEEP
-
Detects Pyinstaller
-
Unsigned PE
Checks for missing Authenticode signature.
Password
infected
Minor OS version
2
Major OS version
5
Entry point
45840
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
user32
CreateWindowExW
MessageBoxW
MessageBoxA
SystemParametersInfoW
DestroyIcon
SetWindowLongPtrW
GetWindowLongPtrW
GetClientRect
InvalidateRect
ReleaseDC
GetDC
DrawTextW
GetDialogBaseUnits
EndDialog
DialogBoxIndirectParamW
MoveWindow
SendMessageW
comctl32
ord380
kernel32
GetStringTypeW
GetFileAttributesExW
HeapReAlloc
FlushFileBuffers
GetCurrentDirectoryW
IsValidCodePage
GetACP
GetModuleHandleW
MulDiv
GetLastError
SetDllDirectoryW
GetModuleFileNameW
GetProcAddress
GetCommandLineW
GetEnvironmentVariableW
GetOEMCP
ExpandEnvironmentStringsW
CreateDirectoryW
GetTempPathW
WaitForSingleObject
Sleep
GetExitCodeProcess
CreateProcessW
GetStartupInfoW
FreeLibrary
LoadLibraryExW
SetConsoleCtrlHandler
FindClose
FindFirstFileExW
CloseHandle
GetCurrentProcess
LocalFree
FormatMessageW
MultiByteToWideChar
WideCharToMultiByte
GetCPInfo
GetEnvironmentStringsW
FreeEnvironmentStringsW
GetProcessHeap
GetTimeZoneInformation
HeapSize
WriteConsoleW
SetEnvironmentVariableW
RtlUnwindEx
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
UnhandledExceptionFilter
SetUnhandledExceptionFilter
TerminateProcess
IsProcessorFeaturePresent
QueryPerformanceCounter
GetCurrentProcessId
GetCurrentThreadId
GetSystemTimeAsFileTime
InitializeSListHead
IsDebuggerPresent
SetEndOfFile
SetLastError
EnterCriticalSection
LeaveCriticalSection
DeleteCriticalSection
InitializeCriticalSectionAndSpinCount
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
EncodePointer
RaiseException
RtlPcToFileHeader
GetCommandLineA
CreateFileW
GetDriveTypeW
GetFileInformationByHandle
GetFileType
PeekNamedPipe
SystemTimeToTzSpecificLocalTime
FileTimeToSystemTime
GetFullPathNameW
RemoveDirectoryW
FindNextFileW
SetStdHandle
DeleteFileW
ReadFile
GetStdHandle
WriteFile
ExitProcess
GetModuleHandleExW
HeapFree
GetConsoleMode
ReadConsoleW
SetFilePointerEx
GetConsoleOutputCP
GetFileSizeEx
HeapAlloc
FlsAlloc
FlsGetValue
FlsSetValue
FlsFree
CompareStringW
LCMapStringW
advapi32
OpenProcessToken
GetTokenInformation
ConvertStringSecurityDescriptorToSecurityDescriptorW
ConvertSidToStringSidW
gdi32
SelectObject
DeleteObject
CreateFontIndirectW
Name
.text
Size
162KB
Virtual Size
162KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
75KB
Virtual Size
74KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
3KB
Virtual Size
64KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
8KB
Virtual Size
8KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
_RDATA
Size
512B
Virtual Size
348B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
12KB
Virtual Size
12KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
2KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=7, id=259, version=30795,
count=191, id=261, version=30795,
count=10, id=260, version=30795,
count=4, id=253, version=31823,
count=40, id=261, version=31823,
count=17, id=260, version=31823,
count=9, id=259, version=31823,
count=11, id=257, version=30795,
count=139, id=1, productName=Unmarked objects,
count=20, id=260, version=31943,
count=1, id=258, version=31943,
main.pyc
- SHA256 56d84b7b2b1c1dabee83717824f429b527fa0abf815fa9c2d9a42b63d5f58957
- MD5 dca716030ca4b125176f7eacf21fc3c8
- SHA1 9b5650b6da7d68e77bc785e7e388cc9697b59432
- SHA512 fdd99ad4379617a92e2ef5bf87c3c2f5cb013b1eaab0855b99f8eef8af9db85fab03d3a07a4e6b2ec5a6b93ecde50c6b0de403d5820ad73812dc3d585c35bdf9
- SSDEEP 384:LOy85KboIlWm2a/QkusQTz2Wuu4P2cwC7QR:aykH2Wm9utTy7u4+bC7QR
- MD5 SHA1 SHA512 SSDEEP
win7/win6.exe
- IMPHASH e44f44f1060dd800fd861c4e5ad59e21
- SHA256 0ec75e29acf2a905f1061e1c051bd34ef6ba01e216f8cf0f43db983eb0e6d5a4
- MD5 54da1e18625df8635098673f7910ef0a
- SHA1 a7093de871853b6b2ee0a506dc2e40d56f2b2cea
- SHA512 1d50dc05bd4e74fbf19bf492ba35111af75167d7822ba866e6557b8fa3090795c990b7ce1fa3a88cba9e315b51b8212fa6e32fcd9ffc1514f007f30d8fa2820f
- SSDEEP 196608:3ZpWwkjiVXF4ckmkXnVFPQ/WQ9pQeHSXhLZmftMbjUFrNWk:3FVV41lFPpQ9GdxMftMbjkN5
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Password
infected
Minor OS version
0
Major OS version
4
Entry point
4342
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DEBUG_STRIPPED
PDB paths
kernel32
CloseHandle
CopyFileW
CreateDirectoryW
CreateFileMappingW
CreateFileW
CreateProcessW
DeleteCriticalSection
DeleteFileW
EnterCriticalSection
FindResourceA
FormatMessageA
FreeLibrary
GenerateConsoleCtrlEvent
GetCommandLineW
GetCurrentProcessId
GetEnvironmentVariableW
GetExitCodeProcess
GetFileAttributesW
GetFileSize
GetLastError
GetModuleFileNameW
GetModuleHandleA
GetProcAddress
GetProcessId
GetStartupInfoW
GetSystemTimeAsFileTime
GetTempPathW
InitializeCriticalSection
IsDBCSLeadByteEx
LeaveCriticalSection
LoadLibraryA
LoadResource
LockResource
MapViewOfFile
MultiByteToWideChar
ReadFile
SetConsoleCtrlHandler
SetEnvironmentVariableW
SetUnhandledExceptionFilter
SizeofResource
Sleep
TerminateProcess
TlsGetValue
UnmapViewOfFile
VirtualProtect
VirtualQuery
WaitForSingleObject
WideCharToMultiByte
WriteFile
msvcrt
__C_specific_handler
___lc_codepage_func
___mb_cur_max_func
__iob_func
__set_app_type
__setusermatherr
__wargv
__wgetmainargs
__winitenv
_amsg_exit
_cexit
_commode
_errno
_fmode
_initterm
_lock
_onexit
_unlock
_wcmdln
_wcsdup
_wcsicmp
_wrename
abort
calloc
exit
fprintf
fputc
free
fwrite
localeconv
malloc
mbstowcs
memcpy
memmove
memset
puts
signal
strerror
strlen
strncmp
vfprintf
wcscmp
wcslen
wcsncmp
shell32
SHFileOperationW
SHGetFolderPathW
Name
.text
Size
107KB
Virtual Size
107KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.data
Size
512B
Virtual Size
272B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rdata
Size
11KB
Virtual Size
10KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.eh_fram
Size
512B
Virtual Size
4B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
2KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.xdata
Size
2KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.bss
Size
Virtual Size
71KB
Characteristics
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.idata
Size
3KB
Virtual Size
3KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.CRT
Size
512B
Virtual Size
96B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.tls
Size
512B
Virtual Size
16B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
8.3MB
Virtual Size
8.3MB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
148B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ