Analysis
-
max time kernel
118s -
max time network
119s -
platform
windows7_x64 -
resource
win7-20240704-en -
resource tags
-
submitted
31-08-2024 11:09
General
-
Target
b8c51381be7ad925631d87518c845980N.exe
-
Size
250KB
-
MD5
b8c51381be7ad925631d87518c845980
-
SHA1
257404d39215cdaf65f78fe632f69dd94e154d38
-
SHA256
efc24d23ceeb2fa3687735caef9f5679cfba72d7e48e97f5b0511ddbe3f658c7
-
SHA512
5f01882737fe778656330ea14eb7ad920d5baa062efa9eec35e64892f5d945734ecc0edb27919714187f73e876a4fd4f1a0a8082ab573cea7e5f3c6d988b2caf
-
SSDEEP
1536:/UxQcxHCapCtGPMVCe9VdQuDIqH1bd/OW13QzcSLVclN:/UOcxHCoeGPMVCe9VdQ4H1bdWGQTBY
Score
10/10
Malware Config
Extracted
Family
asyncrat
Version
Venom RAT + HVNC + Stealer + Grabber v6.0.3
Botnet
Vitima
C2
191.215.199.248:4449
Mutex
pqmjwdssgfg
Attributes
-
delay
1
-
install
true
-
install_file
System.exe
-
install_folder
%AppData%
aes.plain
Signatures
-
AsyncRat
AsyncRAT is designed to remotely monitor and control other computers written in C#.
-
VenomRAT 1 IoCs
Detects VenomRAT.
-
Suspicious use of AdjustPrivilegeToken 41 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\b8c51381be7ad925631d87518c845980N.exe"C:\Users\Admin\AppData\Local\Temp\b8c51381be7ad925631d87518c845980N.exe"1⤵
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
4KB
-
Filesize
272KB
-
Filesize
9.9MB
-
Filesize
9.9MB