Overview

overview

10

Static

static

3

34c2047d0b...0N.exe

windows7-x64

10

34c2047d0b...0N.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    34c2047d0b69ba023b700c21431accc0N.exe

  • Size

    258KB

  • Sample

    240716-ahlnaayeqf

  • MD5

    34c2047d0b69ba023b700c21431accc0

  • SHA1

    e34c28611707c81565cb73d8a1a46dfc3ab2495a

  • SHA256

    ff9b39d07fd6e4a7f98d109664d91de9e318671da6412da85396541722d92799

  • SHA512

    a1566d65beb8135edfcb5c4a09631bc17dff56db672621990a10d0eff37a0290c7e1e9705f1918a7e719cbea4b1cecc29bb8254da946108e9bd5432070cc8ca7

  • SSDEEP

    6144:VbJhs7QW69hd1MMdxPe9N9uA0hu9TBrjJ0Xxne0AqGLj:VbjDhu9TV6xeJqG3

Score
10/10
asyncratdefaultdiscoveryexecutionlinkpdfrat

Malware Config

Extracted

Language
ps1
Deobfuscated
URLs
exe.dropper

http://thelustfactory.com/vns/1.ps1

Extracted

Language
ps1
Deobfuscated
URLs
exe.dropper

http://thelustfactory.com/vns/2.ps1

Extracted

Language
ps1
Deobfuscated
URLs
exe.dropper

http://thelustfactory.com/vns/winrar.exe

Extracted

Family

asyncrat

Version

Venom RAT + HVNC + Stealer + Grabber v6.0.3

Botnet

Default

C2

54.153.17.157:14445

Mutex

rpujporiumcisxsdyop

Attributes
  • delay

    1

  • install

    false

  • install_folder

    %AppData%

aes.plain

Targets

    • Target

      34c2047d0b69ba023b700c21431accc0N.exe

    • Size

      258KB

    • MD5

      34c2047d0b69ba023b700c21431accc0

    • SHA1

      e34c28611707c81565cb73d8a1a46dfc3ab2495a

    • SHA256

      ff9b39d07fd6e4a7f98d109664d91de9e318671da6412da85396541722d92799

    • SHA512

      a1566d65beb8135edfcb5c4a09631bc17dff56db672621990a10d0eff37a0290c7e1e9705f1918a7e719cbea4b1cecc29bb8254da946108e9bd5432070cc8ca7

    • SSDEEP

      6144:VbJhs7QW69hd1MMdxPe9N9uA0hu9TBrjJ0Xxne0AqGLj:VbjDhu9TV6xeJqG3

    Score
    10/10
    executionlinkpdfasyncratdefaultdiscoveryrat

    • AsyncRat

      AsyncRAT is designed to remotely monitor and control other computers written in C#.

      ratasyncrat

    • Async RAT payload

      rat

    • Blocklisted process makes network request

    • Downloads MZ/PE file

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

      discovery
    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks