Analysis
-
max time kernel
119s -
max time network
17s -
platform
windows7_x64 -
resource
win7-20240705-en -
resource tags
-
submitted
04-08-2024 06:36
General
-
Target
e48a86cfea082b38eadf0dbfb5a34fd0N.exe
-
Size
78KB
-
MD5
e48a86cfea082b38eadf0dbfb5a34fd0
-
SHA1
0f7e15ecad26cf669d2f006ece5856468f97ce04
-
SHA256
3a7440f16f889f5aae7a85dd4dcdb268135afc142871863ddf0136207a2630a3
-
SHA512
4671c71113101ae8a23cfd6a26e7f2a03679ff9b0fbfb61af11826d81b7f78315a1b689e8a589e817c66c152ecbac7b27189c78b017d5ac9a5fde8e32f3fdb83
-
SSDEEP
1536:FpUkgcxG8JCjWPMV2PjOYHTnIzH1bm/iK2aQzcwhDOlVclN:bUBcxGaQWPMV2PriH1bm59QGHY
Score
10/10
Malware Config
Extracted
Family
asyncrat
Version
Venom RAT + HVNC + Stealer + Grabber v6.0.3
Botnet
Default
Mutex
xgtsrifqystcubbka
Attributes
-
delay
1
-
install
true
-
install_file
Youtube.exe
-
install_folder
%Temp%
-
pastebin_config
https://pastebin.com/raw/XyFPn10U
aes.plain
Signatures
-
AsyncRat
AsyncRAT is designed to remotely monitor and control other computers written in C#.
-
VenomRAT 1 IoCs
Detects VenomRAT.
-
Suspicious use of AdjustPrivilegeToken 41 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\e48a86cfea082b38eadf0dbfb5a34fd0N.exe"C:\Users\Admin\AppData\Local\Temp\e48a86cfea082b38eadf0dbfb5a34fd0N.exe"1⤵
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
4KB
-
Filesize
96KB
-
Filesize
9.9MB
-
Filesize
9.9MB