Overview

overview

10

Static

static

10

331f31d4be...8b.exe

windows7-x64

10

331f31d4be...8b.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    331f31d4be0ff0f371a8804524359ce455e481c32e00cd75d0c5a7973a17a18b

  • Size

    73KB

  • Sample

    240818-xa3m6axgpb

  • MD5

    3a3e19b6e7cf03c8c66839db4ebd031f

  • SHA1

    b2a0bec39e05062bb7dd47ee7d57ab9e4ee0f817

  • SHA256

    331f31d4be0ff0f371a8804524359ce455e481c32e00cd75d0c5a7973a17a18b

  • SHA512

    525dc8e997fbc180dc1ac3c137f5c265a7b4268435a83523ef4005de38361e449255f1ea3c5f12fd21673553e0d7738bd72be9034022cbc2d177a2a123fcc9a7

  • SSDEEP

    1536:sU/wcxea0CTmPMVWe9VdQkhDIyH1bf/MxTKWmQzcX3VclN:sUIcxeFImPMVWe9VdQgH1bfUxT1mQilY

Score
10/10
asyncratvenomratdefaultrat

Malware Config

Extracted

Family

asyncrat

Version

Venom RAT + HVNC + Stealer + Grabber v6.0.3

Botnet

Default

Mutex

etdcxllqrfpos

Attributes
  • delay

    2

  • install

    true

  • install_file

    evert.exe

  • install_folder

    %Temp%

  • pastebin_config

    https://pastebin.com/raw/LwwcrLg4

aes.plain

Targets

    • Target

      331f31d4be0ff0f371a8804524359ce455e481c32e00cd75d0c5a7973a17a18b

    • Size

      73KB

    • MD5

      3a3e19b6e7cf03c8c66839db4ebd031f

    • SHA1

      b2a0bec39e05062bb7dd47ee7d57ab9e4ee0f817

    • SHA256

      331f31d4be0ff0f371a8804524359ce455e481c32e00cd75d0c5a7973a17a18b

    • SHA512

      525dc8e997fbc180dc1ac3c137f5c265a7b4268435a83523ef4005de38361e449255f1ea3c5f12fd21673553e0d7738bd72be9034022cbc2d177a2a123fcc9a7

    • SSDEEP

      1536:sU/wcxea0CTmPMVWe9VdQkhDIyH1bf/MxTKWmQzcX3VclN:sUIcxeFImPMVWe9VdQgH1bfUxT1mQilY

    Score
    10/10
    asyncratdefaultrat

    • AsyncRat

      AsyncRAT is designed to remotely monitor and control other computers written in C#.

      ratasyncrat

    • VenomRAT

      Detects VenomRAT.

      rat

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Loads dropped DLL

    • Legitimate hosting services abused for malware hosting/C2

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks