General

  • Target
    f8f9913e070a0ef683f16c0932cbe1664933d0079f4b1b23d5c2abf3b8c18208N
  • Size 74KB
  • Sample240917-m4xc5azalg
  • SHA256 f8f9913e070a0ef683f16c0932cbe1664933d0079f4b1b23d5c2abf3b8c18208
  • MD5 SHA1 SHA512 SSDEEP

Malware Config

Extracted

Family
  • asyncrat

Version
  • Venom RAT + HVNC + Stealer + Grabber v6.0.3

Botnet
  • Default

C2
  • 45.131.109.206:4449

Mutex
  • uojkfdfvuzyucny

Attributes
  • delay

    1

  • install

    false

  • install_folder

    %AppData%

aes.plain

Targets

    • Target
      f8f9913e070a0ef683f16c0932cbe1664933d0079f4b1b23d5c2abf3b8c18208N
    • Size 74KB
    • SHA256 f8f9913e070a0ef683f16c0932cbe1664933d0079f4b1b23d5c2abf3b8c18208
    • MD5 SHA1 SHA512 SSDEEP
    • AsyncRat

      AsyncRAT is designed to remotely monitor and control other computers written in C#.

    • StormKitty

      StormKitty is an open source info stealer written in C#.

    • StormKitty payload

    • VenomRAT

      Detects VenomRAT.

    • Credentials from Password Stores: Credentials from Web Browsers

      Malicious Access or copy of Web Browser Credential store.

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

MITRE ATT&CK Enterprise v15

Tasks