General

  • Target

    bd2f7b22890ba0838cbd19c243195e7efacf5e612a0465194a1ac00800ce94e0

  • Size

    272KB

  • Sample

    240818-xm664sscjn

  • MD5

    bf0cf091125bfd2c3a318ce8bedcf170

  • SHA1

    4c5ecc559a5514e5f843e7743e5b6433733ded9c

  • SHA256

    bd2f7b22890ba0838cbd19c243195e7efacf5e612a0465194a1ac00800ce94e0

  • SHA512

    c5f5929af0204fb32fa75acad175d60a80d4b55d9e37d690dde2edc0b77b95c8d4ce63f82514bc136b33394e3484909f772ef89a4d19fdfba758739a340368ff

  • SSDEEP

    3072:DUEcxbgwmPMVOe9VdQsH1bfFpQAy9ckYMmlB/v6A80XH3e55EVu9cBY:DtwmPMVOaesVb7y5YM6VyA80XHbUe

Malware Config

Extracted

Family

asyncrat

Version

Venom RAT + HVNC + Stealer + Grabber v6.0.3

Botnet

Default

C2

127.0.0.1:4449

127.0.0.1:6703

147.185.221.21:4449

147.185.221.21:6703

Mutex

ftbmdvxzjxuuvgonhfr

Attributes
  • delay

    1

  • install

    true

  • install_file

    Eaxset.exe

  • install_folder

    %AppData%

aes.plain

Targets

    • Target

      bd2f7b22890ba0838cbd19c243195e7efacf5e612a0465194a1ac00800ce94e0

    • Size

      272KB

    • MD5

      bf0cf091125bfd2c3a318ce8bedcf170

    • SHA1

      4c5ecc559a5514e5f843e7743e5b6433733ded9c

    • SHA256

      bd2f7b22890ba0838cbd19c243195e7efacf5e612a0465194a1ac00800ce94e0

    • SHA512

      c5f5929af0204fb32fa75acad175d60a80d4b55d9e37d690dde2edc0b77b95c8d4ce63f82514bc136b33394e3484909f772ef89a4d19fdfba758739a340368ff

    • SSDEEP

      3072:DUEcxbgwmPMVOe9VdQsH1bfFpQAy9ckYMmlB/v6A80XH3e55EVu9cBY:DtwmPMVOaesVb7y5YM6VyA80XHbUe

    Score
    10/10
    • AsyncRat

      AsyncRAT is designed to remotely monitor and control other computers written in C#.

    • VenomRAT

      Detects VenomRAT.

    • Async RAT payload

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

MITRE ATT&CK Enterprise v15

Tasks