General

  • Target

    Desty.zip

  • Size

    122.3MB

  • MD5

    ccbfce17a781e489422d277bbfc23e30

  • SHA1

    4cf1c10ab355b8c9d3a17941a1d74ab9bfb3f0f5

  • SHA256

    7f84b9d1710249e6194cf77d1bd58cdb0eef49ff1e502bbea5a586f5c2b9aa70

  • SHA512

    cd36777959abe9ad99c77662288b35c8adb92a6c47eb6d77b0ddbafc15c569f948f2ca782f81862a254bd07d42518da519beef8d1b449334aed8c41c2a2baa85

  • SSDEEP

    3145728:WmJFvew2b6jytK4ymGKaIRCR4oTF7d8Ewf7gYjmjv:WoFve/6X4yGaRTTMEU7gkCv

Malware Config

Extracted

Family

asyncrat

Version

Venom RAT + HVNC + Stealer + Grabber v6.0.3

Botnet

Default

C2

127.0.0.1:9090

127.0.0.1:27853

147.185.221.20:9090

147.185.221.20:27853

Mutex

wtiwmavnqbnhro

Attributes
  • delay

    1

  • install

    true

  • install_file

    msedge.exe

  • install_folder

    %AppData%

aes.plain
aes.plain

Signatures

  • An infostealer written in Python and packaged with PyInstaller. 1 IoCs
  • Async RAT payload 2 IoCs
  • Asyncrat family
  • Crealstealer family
  • Detects Pyinstaller 1 IoCs
  • Unsigned PE 14 IoCs

    Checks for missing Authenticode signature.

Files

  • Desty.zip
    .zip
  • CefSharp.BrowserSubprocess.Core.dll
    .dll windows:6 windows x86 arch:x86

    3a354378d7911ad24a4c1baa743840a6


    Headers

    Imports

    Exports

    Sections

  • CefSharp.BrowserSubprocess.exe
    .exe windows:4 windows x86 arch:x86

    f34d5f2d4577ed6d9ceec516c1f5a744


    Headers

    Imports

    Sections

  • CefSharp.Core.Runtime.dll
    .dll windows:6 windows x86 arch:x86

    d23845f7e2c02b1e4c42d565033f24b6


    Headers

    Imports

    Exports

    Sections

  • CefSharp.Core.dll
    .dll windows:4 windows x86 arch:x86

    dae02f32a21e03ce65412f6e56942daa


    Headers

    Imports

    Sections

  • CefSharp.Wpf.dll
    .dll windows:4 windows x86 arch:x86

    dae02f32a21e03ce65412f6e56942daa


    Headers

    Imports

    Sections

  • CefSharp.dll
    .dll windows:4 windows x86 arch:x86

    dae02f32a21e03ce65412f6e56942daa


    Headers

    Imports

    Sections

  • Client.exe
    .exe windows:4 windows x86 arch:x86

    f34d5f2d4577ed6d9ceec516c1f5a744


    Headers

    Imports

    Sections

  • DestyApi.json
  • DestyInstaller.exe
    .exe windows:5 windows x64 arch:x64

    2ac23c52e7647c5bbea38e98bb68c652


    Headers

    Imports

    Sections

  • Creal.pyc
  • Readme.txt
  • Updater.exe
    .exe windows:4 windows x86 arch:x86

    f34d5f2d4577ed6d9ceec516c1f5a744


    Headers

    Imports

    Sections

  • chrome_100_percent.pak
  • chrome_200_percent.pak
  • chrome_elf.dll
    .dll windows:10 windows x86 arch:x86

    97ef66d9acbb16197c0ab78b072b202f


    Headers

    Imports

    Exports

    Sections

  • d3dcompiler_47.dll
    .dll windows:10 windows x86 arch:x86

    7f269ea2d96d8d376f2c7642ddadc7bc


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • debug.log
  • icudtl.dat
  • libEGL.dll
    .dll windows:10 windows x86 arch:x86

    14cd5ffd5d2a5e20eb8ffa21377b813a


    Headers

    Imports

    Exports

    Sections

  • libGLESv2.dll
    .dll windows:10 windows x86 arch:x86

    9c4c04195a583fb756682a21cfcd595b


    Headers

    Imports

    Exports

    Sections

  • libcef.dll
    .dll windows:10 windows x86 arch:x86

    173dbc07fec1dc253807e3b8c3990689


    Headers

    Imports

    Exports

    Sections

  • resources.pak
  • v8_context_snapshot.bin
  • vk_swiftshader.dll
    .dll windows:10 windows x86 arch:x86

    b6ebccdd6147b2522f8349f23510dede


    Headers

    Imports

    Exports

    Sections