Analysis
-
max time kernel
120s -
max time network
120s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
-
submitted
10-09-2024 18:29
General
-
Target
0240a31465bf98941aa27a82a9c0ac0a5c93c1283d01275c15c3d03d0cd392e4.exe
-
Size
226KB
-
MD5
44f26f37ab5798ce1eeba3e4addb346c
-
SHA1
40d9f64afd266806695ff85931f7d5fb716ee05d
-
SHA256
0240a31465bf98941aa27a82a9c0ac0a5c93c1283d01275c15c3d03d0cd392e4
-
SHA512
0fc37afc0f6dfc20cec21e8df177505f8a87cad916bbda409e6f0294cf5dafd8805919ce744699e334495acc8bc1589811b23e5b6aed080d0d03979df07d87c5
-
SSDEEP
6144:FQT6PMVasVb5B6cyDexP8Z5j1aBHrOjDh8pYm6:FQTBTBrtrcC6m6
Score
10/10
Malware Config
Extracted
Family
asyncrat
Version
Venom RAT + HVNC + Stealer + Grabber v6.0.3
Botnet
txttttt
Mutex
spoder-manLOL
Attributes
-
delay
9
-
install
true
-
install_file
aplegends.exe
-
install_folder
%AppData%
-
pastebin_config
https://pastebin.com/raw/LwwcrLg4
aes.plain
Signatures
-
AsyncRat
AsyncRAT is designed to remotely monitor and control other computers written in C#.
-
VenomRAT 1 IoCs
Detects VenomRAT.
-
Suspicious use of AdjustPrivilegeToken 41 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\0240a31465bf98941aa27a82a9c0ac0a5c93c1283d01275c15c3d03d0cd392e4.exe"C:\Users\Admin\AppData\Local\Temp\0240a31465bf98941aa27a82a9c0ac0a5c93c1283d01275c15c3d03d0cd392e4.exe"1⤵
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
4KB
-
Filesize
248KB
-
Filesize
9.9MB
-
Filesize
4KB
-
Filesize
9.9MB
-
Filesize
9.9MB