General

  • Target

    VenomCrypter.exe

  • Size

    1.2MB

  • Sample

    240709-1mr9qsyhrf

  • MD5

    0dd4afc178581426eae6370f3e2b7d41

  • SHA1

    3caa0504f8b93faa0b58726d5c82f8d0fd8f3b41

  • SHA256

    6980471f4e5af800df1c549940675788c8ff92a0407a158ba2bd56fe538707d9

  • SHA512

    7d3a15cdf1c1dbb5e6739a9779afc137137ea5c98db5046a532b28346950cc405e3819be72eea118b7daa2fb74bde939f4c7642512cfd272522d21277ef3bfd2

  • SSDEEP

    24576:LPB8s2XJdEYkvgmv4TygXmLNgCIV+ExBzJz1xkTtFiqEamN4t7g6tb:LPcfEsBmBifz1UFiqEzNy7g6t

Score
10/10

Malware Config

Extracted

Family

asyncrat

Version

Venom RAT + HVNC + Stealer + Grabber v6.0.3

Botnet

veno

C2

2.58.56.168:4449

Mutex

TeamViewer_732dvers_28uw

Attributes
  • delay

    1

  • install

    false

  • install_folder

    %AppData%

aes.plain

Targets

    • Target

      VenomCrypter.exe

    • Size

      1.2MB

    • MD5

      0dd4afc178581426eae6370f3e2b7d41

    • SHA1

      3caa0504f8b93faa0b58726d5c82f8d0fd8f3b41

    • SHA256

      6980471f4e5af800df1c549940675788c8ff92a0407a158ba2bd56fe538707d9

    • SHA512

      7d3a15cdf1c1dbb5e6739a9779afc137137ea5c98db5046a532b28346950cc405e3819be72eea118b7daa2fb74bde939f4c7642512cfd272522d21277ef3bfd2

    • SSDEEP

      24576:LPB8s2XJdEYkvgmv4TygXmLNgCIV+ExBzJz1xkTtFiqEamN4t7g6tb:LPcfEsBmBifz1UFiqEzNy7g6t

    Score
    10/10
    • AsyncRat

      AsyncRAT is designed to remotely monitor and control other computers written in C#.

    • Async RAT payload

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

MITRE ATT&CK Enterprise v15

Tasks