Behavioral task
behavioral1
Sample
73d8c7c3236f5313722ae15dc5882cf91d4ec87151b655951235028bbfc20d73.exe
Resource
win7-20240705-en
Behavioral task
behavioral2
Sample
73d8c7c3236f5313722ae15dc5882cf91d4ec87151b655951235028bbfc20d73.exe
Resource
win10v2004-20240802-en
General
-
Target
73d8c7c3236f5313722ae15dc5882cf91d4ec87151b655951235028bbfc20d73
-
Size
74KB
-
MD5
4ef5057228905721586da0d52be09db1
-
SHA1
d0df8401238bcab9390bb370a607a69bc226a0fe
-
SHA256
73d8c7c3236f5313722ae15dc5882cf91d4ec87151b655951235028bbfc20d73
-
SHA512
77f2bb849668b4415fbc22d351e31d7103edf1a61e387d9203a493baac99b37de37dda51cec1baf8d057ccd2094788eb3866b64421a6c72b94e8f38c38675d6c
-
SSDEEP
1536:gUtccx79C+CI6PMVUpDhqlIjH1bT/T+fQzc+LVclN:gUucx79DX6PMVUpDUIH1bTSfQXBY
Malware Config
Extracted
asyncrat
Venom RAT + HVNC + Stealer + Grabber v6.0.3
Valorant_Free_Version
psfohsesha
-
delay
1
-
install
true
-
install_file
Valorant_Free_Version.exe
-
install_folder
%AppData%
-
pastebin_config
https://pastebin.ai/raw/046ofaa9x2
Signatures
-
Async RAT payload 1 IoCs
Processes:
resource yara_rule sample family_asyncrat -
Asyncrat family
-
Processes:
resource yara_rule sample VenomRAT -
Venomrat family
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
Processes:
resource 73d8c7c3236f5313722ae15dc5882cf91d4ec87151b655951235028bbfc20d73
Files
-
73d8c7c3236f5313722ae15dc5882cf91d4ec87151b655951235028bbfc20d73.exe windows:4 windows x86 arch:x86
f34d5f2d4577ed6d9ceec516c1f5a744
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
Imports
mscoree
_CorExeMain
Sections
.text Size: 69KB - Virtual size: 69KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 3KB - Virtual size: 3KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ