Behavioral task
behavioral1
Sample
2022335100e772e88fca34bc93c064112f8b0d966b5d550277445e8ca8a3aa35.exe
Resource
win7-20240705-en
General
-
Target
2022335100e772e88fca34bc93c064112f8b0d966b5d550277445e8ca8a3aa35
-
Size
74KB
-
MD5
52798305f5af009c6463de065b7720ac
-
SHA1
f333debd12556179da79787230edd74ac0595a35
-
SHA256
2022335100e772e88fca34bc93c064112f8b0d966b5d550277445e8ca8a3aa35
-
SHA512
9ca907c52cdcde217c69cdf45c52cec01035fd04de520b7b15a9496379a7c59020e8f9738b5ed850929373339700b5cdc1dd5e17757950a12d47e6843c6d5ce3
-
SSDEEP
1536:cyXUyccx4m3Cmv6PMVqmD7a3ISM1bh/gpEQzcWLVclN:cyXUjcx4qB6PMVa7M1bhopEQvBY
Malware Config
Extracted
asyncrat
Venom RAT + HVNC + Stealer + Grabber v6.0.3
plaka
xgdhkdlzdpzntmowf
-
delay
1
-
install
false
-
install_file
plaka
-
install_folder
%AppData%
-
pastebin_config
https://pastebin.ai/raw/eydfn79gkq
Signatures
-
Async RAT payload 1 IoCs
Processes:
resource yara_rule sample family_asyncrat -
Asyncrat family
-
Processes:
resource yara_rule sample VenomRAT -
Venomrat family
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
Processes:
resource 2022335100e772e88fca34bc93c064112f8b0d966b5d550277445e8ca8a3aa35
Files
-
2022335100e772e88fca34bc93c064112f8b0d966b5d550277445e8ca8a3aa35.exe windows:4 windows x86 arch:x86
f34d5f2d4577ed6d9ceec516c1f5a744
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
Imports
mscoree
_CorExeMain
Sections
.text Size: 69KB - Virtual size: 69KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 3KB - Virtual size: 3KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ