General
-
Target
e34009211e3fc2f56b92d9754e2436eee863031a9ff24f44db6c7958c67f6c9d
-
Size
74KB
-
Sample
240818-xry2asseml
-
MD5
483ea502e0c3fa73f8384ece68e0cfc0
-
SHA1
a01d7e6ced28a41e03c4aa651ce68c9e855a0489
-
SHA256
e34009211e3fc2f56b92d9754e2436eee863031a9ff24f44db6c7958c67f6c9d
-
SHA512
8d610258c0b1e953bb1b22cf39bce267875e76039ff8ec13221ea236c48e2c88e275e650e8ec323ae107b6435d34ea60f3760dcc81761a59a266d34b5e0360a0
-
SSDEEP
1536:FUSwcxea0CTmPMVWe9VdQuDI6H1bf/DEhQzcKLVclN:FUTcxeFImPMVWe9VdQsH1bfrEhQ7BY
Behavioral task
behavioral1
Sample
e34009211e3fc2f56b92d9754e2436eee863031a9ff24f44db6c7958c67f6c9d.exe
Resource
win7-20240729-en
Malware Config
Extracted
asyncrat
Venom RAT + HVNC + Stealer + Grabber v6.0.3
Default
127.0.0.1:4449
127.0.0.1:0
85.105.91.170:4449
85.105.91.170:0
magtzafsfzjwekrq
-
delay
1
-
install
true
-
install_file
aa.exe
-
install_folder
%AppData%
Targets
-
-
Target
e34009211e3fc2f56b92d9754e2436eee863031a9ff24f44db6c7958c67f6c9d
-
Size
74KB
-
MD5
483ea502e0c3fa73f8384ece68e0cfc0
-
SHA1
a01d7e6ced28a41e03c4aa651ce68c9e855a0489
-
SHA256
e34009211e3fc2f56b92d9754e2436eee863031a9ff24f44db6c7958c67f6c9d
-
SHA512
8d610258c0b1e953bb1b22cf39bce267875e76039ff8ec13221ea236c48e2c88e275e650e8ec323ae107b6435d34ea60f3760dcc81761a59a266d34b5e0360a0
-
SSDEEP
1536:FUSwcxea0CTmPMVWe9VdQuDI6H1bf/DEhQzcKLVclN:FUTcxeFImPMVWe9VdQsH1bfrEhQ7BY
-
Async RAT payload
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE
-