Analysis
-
max time kernel
386s -
max time network
407s -
platform
windows11-21h2_x64 -
resource
win11-20240802-en -
resource tags
-
submitted
27-09-2024 20:25
General
-
Target
VenomRAT v6.0.3_p_/Client.exe
-
Size
73KB
-
MD5
5d6802a39c1bea84e1bd3e6ba23b7bbb
-
SHA1
17b6040dcd0dc6c0cf794b6d95ed4da0f07ef0b9
-
SHA256
d1fd56cb9943f5b185c8ee52a34f7ea4d34c5091f77ea18138f1d13a8951dd5e
-
SHA512
55df1ab721022d363b6d454ab496b7cc542702edda0525037cc8f0c33a1d93bc50ed62be8d4b95ba1248d7fee5b806d599ddce5e3ff6a9d4464e3047a0ee799d
-
SSDEEP
1536:LUUPcxVteCW7PMVee9VdQkhDIyH1bf/mc6QzcajVclNw:LUmcxV4x7PMVee9VdQgH1bfd6QLJY+
Score
10/10
Malware Config
Extracted
Family
asyncrat
Version
Venom RAT + HVNC + Stealer + Grabber v6.0.3
Botnet
Default
C2
93.82.44.26:4040
Mutex
nheplizwdi
Attributes
-
delay
1
-
install
false
-
install_folder
%AppData%
aes.plain
Signatures
-
AsyncRat
AsyncRAT is designed to remotely monitor and control other computers written in C#.
-
Suspicious behavior: EnumeratesProcesses 18 IoCs
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
-
Suspicious use of SetWindowsHookEx 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\VenomRAT v6.0.3_p_\Client.exe"C:\Users\Admin\AppData\Local\Temp\VenomRAT v6.0.3_p_\Client.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
88KB
-
Filesize
8KB
-
Filesize
10.8MB
-
Filesize
10.8MB
-
Filesize
8KB
-
Filesize
10.8MB