General

  • Target

    ae1fa5cd3f3c4503275743c6504e60529d6fe6ff61031d4a2b8cb67aaf98c3c0

  • Size

    74KB

  • Sample

    240818-xlp67syekb

  • MD5

    42681e226021bc8ab9b24624ee36f4bc

  • SHA1

    6e13e03622b706ff9ed6fa9d29fc22d70a535d66

  • SHA256

    ae1fa5cd3f3c4503275743c6504e60529d6fe6ff61031d4a2b8cb67aaf98c3c0

  • SHA512

    9df2c9273d0796139583874cf76e22f2fd5128019d55543a1a9b8c8183ef046c4754e09675faede01740afdc08f1672d8d563ea3fbc7f21f07593ec6a226b6c9

  • SSDEEP

    1536:zUq0cxVGlCBiPMVbCXFLMCWf/93I8H1bv/hXu0pQzc2LVclN:zUTcxVMWiPMVeXeCWf/99H1bvpQPBY

Malware Config

Extracted

Family

asyncrat

Version

Venom RAT + HVNC + Stealer + Grabber v6.0.3

Botnet

Default

C2

147.185.221.18:4449

147.185.221.18:324150

Mutex

agcwszxuvzsbkybdmbu

Attributes
  • delay

    1

  • install

    true

  • install_file

    equalizer-apo64.exe

  • install_folder

    %AppData%

aes.plain

Targets

    • Target

      ae1fa5cd3f3c4503275743c6504e60529d6fe6ff61031d4a2b8cb67aaf98c3c0

    • Size

      74KB

    • MD5

      42681e226021bc8ab9b24624ee36f4bc

    • SHA1

      6e13e03622b706ff9ed6fa9d29fc22d70a535d66

    • SHA256

      ae1fa5cd3f3c4503275743c6504e60529d6fe6ff61031d4a2b8cb67aaf98c3c0

    • SHA512

      9df2c9273d0796139583874cf76e22f2fd5128019d55543a1a9b8c8183ef046c4754e09675faede01740afdc08f1672d8d563ea3fbc7f21f07593ec6a226b6c9

    • SSDEEP

      1536:zUq0cxVGlCBiPMVbCXFLMCWf/93I8H1bv/hXu0pQzc2LVclN:zUTcxVMWiPMVeXeCWf/99H1bvpQPBY

    Score
    10/10
    • AsyncRat

      AsyncRAT is designed to remotely monitor and control other computers written in C#.

    • VenomRAT

      Detects VenomRAT.

    • Async RAT payload

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

MITRE ATT&CK Enterprise v15

Tasks