Overview

overview

10

Static

static

3

update.exe

windows7-x64

7

update.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    update.exe

  • Size

    6.6MB

  • Sample

    240708-ddrkhs1eph

  • MD5

    6d1826e57f8473dd421f0c5e8ccd8e5a

  • SHA1

    5c8ee34d2e083d82747e159eea938eed6180ec9e

  • SHA256

    6c69bc74f95eba396347160cfadc919285b6ef8278adf3d800d21a964e5ab103

  • SHA512

    c3eaf2fb84100df35cbffbdb0216f55f56859a3f4f339feb8bddd19cf68d5e55e31284295165ff21926106d21e98090ea6027b11946b632c3cd11b96ebfe3776

  • SSDEEP

    98304:xCI8oJo1hZlzb71QGQCPDbZfxz87le5BLoHLSLgj8NnJwFDDEy2nZsBJ1nCkKQg:UIbJofdQmRKuErSEEJwdFvZnCkK

Score
10/10
asyncratvenom clientspyinstallerrat

Malware Config

Extracted

Family

asyncrat

Version

5.0.5

Botnet

Venom Clients

C2

ujhn.duckdns.org:8520

Mutex

Venom_RAT_HVNC_Mutex_Venom RAT_HVNC

Attributes
  • delay

    1

  • install

    false

  • install_folder

    %AppData%

aes.plain

Targets

    • Target

      update.exe

    • Size

      6.6MB

    • MD5

      6d1826e57f8473dd421f0c5e8ccd8e5a

    • SHA1

      5c8ee34d2e083d82747e159eea938eed6180ec9e

    • SHA256

      6c69bc74f95eba396347160cfadc919285b6ef8278adf3d800d21a964e5ab103

    • SHA512

      c3eaf2fb84100df35cbffbdb0216f55f56859a3f4f339feb8bddd19cf68d5e55e31284295165ff21926106d21e98090ea6027b11946b632c3cd11b96ebfe3776

    • SSDEEP

      98304:xCI8oJo1hZlzb71QGQCPDbZfxz87le5BLoHLSLgj8NnJwFDDEy2nZsBJ1nCkKQg:UIbJofdQmRKuErSEEJwdFvZnCkK

    Score
    10/10
    asyncratvenom clientsrat

    • AsyncRat

      AsyncRAT is designed to remotely monitor and control other computers written in C#.

      ratasyncrat

    • Suspicious use of NtCreateUserProcessOtherParentProcess

    • Async RAT payload

      rat

    • Loads dropped DLL

    behavioral1behavioral2

MITRE ATT&CK Matrix

Tasks