General
-
Target
27d16a4b6970b62bc05c437177605391f7788a3e602e69da9d1375ace81b4ee2
-
Size
74KB
-
Sample
240818-w8xzws1cqr
-
MD5
c3f58ffd73d3afc5cc08a29dc5a864c8
-
SHA1
aad0a8c93043e3a4f7c422278c9c02a016ed55b7
-
SHA256
27d16a4b6970b62bc05c437177605391f7788a3e602e69da9d1375ace81b4ee2
-
SHA512
4d45d348bbbc2d503eea99c7265e68c6ce87cf8be982ba153c6e8e6c58484476fc4287a91f8cff2eaa3f4ff1de04e02b2b4bcb597326c6963b28967670fc50b7
-
SSDEEP
1536:EUgQcxI76jCsGPMV19BsmGYIek1bd/VgSQzceLVclN:EUVcxI7q3GPMVz9jk1bd9Q3BY
Behavioral task
behavioral1
Sample
27d16a4b6970b62bc05c437177605391f7788a3e602e69da9d1375ace81b4ee2.exe
Resource
win7-20240705-en
Malware Config
Extracted
asyncrat
Venom RAT + HVNC + Stealer + Grabber v6.0.3
Default
119.59.98.116:7812
WindowsDefendersecurityService
-
delay
1
-
install
true
-
install_file
Windows Defender Security Service.exe
-
install_folder
%AppData%
Targets
-
-
Target
27d16a4b6970b62bc05c437177605391f7788a3e602e69da9d1375ace81b4ee2
-
Size
74KB
-
MD5
c3f58ffd73d3afc5cc08a29dc5a864c8
-
SHA1
aad0a8c93043e3a4f7c422278c9c02a016ed55b7
-
SHA256
27d16a4b6970b62bc05c437177605391f7788a3e602e69da9d1375ace81b4ee2
-
SHA512
4d45d348bbbc2d503eea99c7265e68c6ce87cf8be982ba153c6e8e6c58484476fc4287a91f8cff2eaa3f4ff1de04e02b2b4bcb597326c6963b28967670fc50b7
-
SSDEEP
1536:EUgQcxI76jCsGPMV19BsmGYIek1bd/VgSQzceLVclN:EUVcxI7q3GPMVz9jk1bd9Q3BY
-
Async RAT payload
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE
-