General

  • Target

    7057a51e8b7ab101a218a8cae24bfb4deca89ef5b16ab32388f883fc14701c48

  • Size

    73KB

  • Sample

    240818-xfyldsyblg

  • MD5

    2a2426c3a0fba674841a931c5a4d47a3

  • SHA1

    8bb2bf45a4993677fda403f0901eb273f41f35ef

  • SHA256

    7057a51e8b7ab101a218a8cae24bfb4deca89ef5b16ab32388f883fc14701c48

  • SHA512

    185933d3e285b47a45ada46e9abd2205d436a1f02499b8807b18842b79e247ec6345c42f89c2a02f552428ea1faa0c01dfa97dccb87488f33edbfb43e5dff387

  • SSDEEP

    1536:u3U6AcxVVWc+pIedLMBqTE9qY26RkGPMwYGXN1tkUdDwH1bFbph4UawzU0bVclN:u3UjcxVVWc+GedLMBqTE9qY26CGPMwYC

Malware Config

Extracted

Family

asyncrat

Version

Venom RAT + HVNC + Stealer + Grabber v6.0.2

Botnet

Default

C2

64.95.12.202:4449

Mutex

xslhfrfpycznyhafrt

Attributes
  • delay

    1

  • install

    true

  • install_file

    client12.exe

  • install_folder

    %AppData%

aes.plain

Targets

    • Target

      7057a51e8b7ab101a218a8cae24bfb4deca89ef5b16ab32388f883fc14701c48

    • Size

      73KB

    • MD5

      2a2426c3a0fba674841a931c5a4d47a3

    • SHA1

      8bb2bf45a4993677fda403f0901eb273f41f35ef

    • SHA256

      7057a51e8b7ab101a218a8cae24bfb4deca89ef5b16ab32388f883fc14701c48

    • SHA512

      185933d3e285b47a45ada46e9abd2205d436a1f02499b8807b18842b79e247ec6345c42f89c2a02f552428ea1faa0c01dfa97dccb87488f33edbfb43e5dff387

    • SSDEEP

      1536:u3U6AcxVVWc+pIedLMBqTE9qY26RkGPMwYGXN1tkUdDwH1bFbph4UawzU0bVclN:u3UjcxVVWc+GedLMBqTE9qY26CGPMwYC

    Score
    10/10
    • AsyncRat

      AsyncRAT is designed to remotely monitor and control other computers written in C#.

    • VenomRAT

      Detects VenomRAT.

    • Async RAT payload

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

MITRE ATT&CK Enterprise v15

Tasks