Overview

overview

10

Static

static

10

Client.exe

windows7-x64

10

Client.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    Client.exe

  • Size

    114KB

  • Sample

    240710-3ydltsxcjk

  • MD5

    29e928f1f16131ca36a3aae3467141de

  • SHA1

    9b586f0d13236c3280e5b7b3b592309b296d7fff

  • SHA256

    5e3758c19d761560431f8fd8302aa6d2061568cbed3dc0a20ad3d4f5da93a956

  • SHA512

    3f4ab2b645ec82c9899061973edb92bc4ef4ef3663603dea0de3a37447b8b94577e1357f398bef02f1ce94260f53f25387de72d872a055d7a9482b1f1b256314

  • SSDEEP

    3072:QUVcxhzVCiPMVSe9VdQsH1bf7ADzQL4KvYMC29TwaGwYSOeBY:QtCiPMVSaesVbUzaFzC2yK

Score
10/10
asyncratdefaultrat

Malware Config

Extracted

Family

asyncrat

Version

Venom RAT + HVNC + Stealer + Grabber v6.0.3

Botnet

Default

C2

127.0.0.1:4449

127.0.0.1:6703

147.185.221.21:4449

147.185.221.21:6703
Mutex

uiagdedifgkrgllefg

Attributes
  • delay

    1

  • install

    true

  • install_file

    dllhost.dat.exe

  • install_folder

    %AppData%

aes.plain

Targets

    • Target

      Client.exe

    • Size

      114KB

    • MD5

      29e928f1f16131ca36a3aae3467141de

    • SHA1

      9b586f0d13236c3280e5b7b3b592309b296d7fff

    • SHA256

      5e3758c19d761560431f8fd8302aa6d2061568cbed3dc0a20ad3d4f5da93a956

    • SHA512

      3f4ab2b645ec82c9899061973edb92bc4ef4ef3663603dea0de3a37447b8b94577e1357f398bef02f1ce94260f53f25387de72d872a055d7a9482b1f1b256314

    • SSDEEP

      3072:QUVcxhzVCiPMVSe9VdQsH1bf7ADzQL4KvYMC29TwaGwYSOeBY:QtCiPMVSaesVbUzaFzC2yK

    Score
    10/10
    asyncratdefaultrat

    • AsyncRat

      AsyncRAT is designed to remotely monitor and control other computers written in C#.

      ratasyncrat

    • Async RAT payload

      rat

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks