Overview

overview

10

Static

static

1

Virus.bat

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    Virus.bat

  • Size

    282KB

  • Sample

    240812-wcgm2asanq

  • MD5

    6321399b9f2a346f9dcd5ddcf0d04837

  • SHA1

    491a27119ef1c8cbe7bafc270cd61d473f404efa

  • SHA256

    4ba666d2a43f4f36ee814d77cf103645e3091dcda9ee350a72f1857a49d62f2d

  • SHA512

    30507019b3f140736a41537662936ce6a3b76b9b38e597e462772dab6cbdfb7821dd10904d379b2ece5911c11ec68c5b2500d2938b0ea08d2837418349ef166b

  • SSDEEP

    6144:NoS40TIG7jmb/lrUlPp4L2yoXhb2yz+FAjFQD4mT5nNfxWFzk/7+JX:NoS40Tr7M/ilRa2jsyCFrL5nB0iSX

Score
10/10
asyncratvenom clientsexecutionrat

Malware Config

Extracted

Family

asyncrat

Version

5.0.5

Botnet

Venom Clients

C2

born-brandon.gl.at.ply.gg:55020

Mutex

Venom_RAT_HVNC_Mutex_Venom RAT_HVNC

Attributes
  • delay

    1

  • install

    true

  • install_file

    Installer.exe

  • install_folder

    %AppData%

aes.plain

Targets

    • Target

      Virus.bat

    • Size

      282KB

    • MD5

      6321399b9f2a346f9dcd5ddcf0d04837

    • SHA1

      491a27119ef1c8cbe7bafc270cd61d473f404efa

    • SHA256

      4ba666d2a43f4f36ee814d77cf103645e3091dcda9ee350a72f1857a49d62f2d

    • SHA512

      30507019b3f140736a41537662936ce6a3b76b9b38e597e462772dab6cbdfb7821dd10904d379b2ece5911c11ec68c5b2500d2938b0ea08d2837418349ef166b

    • SSDEEP

      6144:NoS40TIG7jmb/lrUlPp4L2yoXhb2yz+FAjFQD4mT5nNfxWFzk/7+JX:NoS40Tr7M/ilRa2jsyCFrL5nB0iSX

    Score
    10/10
    asyncratvenom clientsexecutionrat

    • AsyncRat

      AsyncRAT is designed to remotely monitor and control other computers written in C#.

      ratasyncrat

    • Async RAT payload

      rat

    • Command and Scripting Interpreter: PowerShell

      Run Powershell and hide display window.

      execution

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    behavioral1

MITRE ATT&CK Enterprise v15

Tasks