Analysis
-
max time kernel
2s -
platform
windows11-21h2_x64 -
resource
win11-20240709-en -
resource tags
-
submitted
23-07-2024 10:24
General
-
Target
SolaraBootstrapper.exe
-
Size
74KB
-
MD5
15720824476c30893aae571eeeda7eec
-
SHA1
ed12a3a8f54c9cd67eda4b9015e47752bd3cc946
-
SHA256
7be00896eb14f9205ba55bf0b98e93c722b89f74e3dbad937b8016f51cea68e2
-
SHA512
035a2051f8d314de72638f9158fe2e17d49bfc0e1ed862f85ad10d609a866ec0b8435e3418b0da9ddf273fd2bb144df53151deaf2ce52e6b84928aea1e981ab9
-
SSDEEP
1536:zUzkcx4VHsC0SPMVBrqG7YgIFH1bi/gQzc6LVclN:zUwcx4GfSPMVBrqGmH1bioQrBY
Score
10/10
Malware Config
Extracted
Family
asyncrat
Version
Venom RAT + HVNC + Stealer + Grabber v6.0.3
Botnet
Default
C2
127.0.0.1:4449
127.0.0.1:1337
127.0.0.1:60723
147.185.221.18:4449
147.185.221.18:1337
147.185.221.18:60723
Mutex
gqjnxiopseukzyk
Attributes
-
delay
1
-
install
false
-
install_folder
%AppData%
aes.plain
Signatures
-
AsyncRat
AsyncRAT is designed to remotely monitor and control other computers written in C#.
-
Suspicious use of AdjustPrivilegeToken 43 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\SolaraBootstrapper.exe"C:\Users\Admin\AppData\Local\Temp\SolaraBootstrapper.exe"1⤵
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
8KB
-
Filesize
96KB
-
Filesize
10.8MB
-
Filesize
10.8MB