Behavioral task
behavioral1
Sample
0b657c945d9ebee7f0b8a48be6f1abf4b9dbf2c0c609fc8030818a2229dd175e.exe
Resource
win7-20240704-en
General
-
Target
0b657c945d9ebee7f0b8a48be6f1abf4b9dbf2c0c609fc8030818a2229dd175e
-
Size
74KB
-
MD5
3ef6a6f8a984c661f58c373081986213
-
SHA1
13f18179a85ae650bcfa70b47d027b0b3fe84d6e
-
SHA256
0b657c945d9ebee7f0b8a48be6f1abf4b9dbf2c0c609fc8030818a2229dd175e
-
SHA512
e7c6bc2b7e4d5d252b4b05628cab64007e5c0cec15657ee533ec78c7cd4546afb27df7b5b6be82b5d8bda085b93463dadaae41b74ccd6061b0ee7b2f68de27df
-
SSDEEP
1536:SUdccxlfNC86PMVme9VdQuDI6H1bf/g+4oQzcq7VclN:SUecxlFT6PMVme9VdQsH1bf4ZoQ7xY
Malware Config
Extracted
asyncrat
Venom RAT + HVNC + Stealer + Grabber v6.0.3
Default
fwlmnhzadxk
-
delay
1
-
install
true
-
install_file
%AppData%.exe
-
install_folder
%AppData%
-
pastebin_config
https://pastebin.com/raw/w5QC7zcd
Signatures
-
Async RAT payload 1 IoCs
resource yara_rule sample family_asyncrat -
Asyncrat family
-
resource yara_rule sample VenomRAT -
Venomrat family
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 0b657c945d9ebee7f0b8a48be6f1abf4b9dbf2c0c609fc8030818a2229dd175e
Files
-
0b657c945d9ebee7f0b8a48be6f1abf4b9dbf2c0c609fc8030818a2229dd175e.exe windows:4 windows x86 arch:x86
f34d5f2d4577ed6d9ceec516c1f5a744
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
mscoree
_CorExeMain
Sections
.text Size: 69KB - Virtual size: 69KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 3KB - Virtual size: 3KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ