Overview

overview

10

Static

static

10

SpotifyPatch.exe

windows7-x64

10

SpotifyPatch.exe

windows10-1703-x64

10

SpotifyPatch.exe

windows10-2004-x64

10

SpotifyPatch.exe

windows11-21h2-x64

10

SpotifyPatch.exe

macos-10.15-amd64

1

SpotifyPatch.exe

macos-10.15-amd64

4

SpotifyPatch.exe

debian-12-armhf

SpotifyPatch.exe

debian-12-mipsel

SpotifyPatch.exe

debian-9-armhf

SpotifyPatch.exe

debian-9-mips

SpotifyPatch.exe

debian-9-mipsel

SpotifyPatch.exe

ubuntu-18.04-amd64

SpotifyPatch.exe

ubuntu-20.04-amd64

SpotifyPatch.exe

ubuntu-22.04-amd64

SpotifyPatch.exe

ubuntu-24.04-amd64

Sharing

Copy URL
Twitter E-mail

General

  • Target

    SpotifyPatch.exe

  • Size

    129KB

  • MD5

    4ed5ceebb1fd4b6bbc4eb963676f4ac1

  • SHA1

    b3c2f3900fa231849697c008c3deedbf0d2510f4

  • SHA256

    08f7f44b07fb6e06a731314aaaaa0d4ee2aa1f98b3ce45437e5b150c0ba6575e

  • SHA512

    cbc6a1f5a07dedeee42bc50a731a83f2d8eb6faf918484e16d947f7f0c041e3203ac151b75017d2418b054e6e4f6b09efd75f2bdb4fdcb7efcc10b44c7ad3664

  • SSDEEP

    1536:ckbdDbhR3fV9BJbFXGbbwSo9ljVGKc27pqKmY7:c8DbhR3tdlGbbwx91Hoz

Score
10/10
ratvenom clientsasyncrat

Malware Config

Extracted

Family

asyncrat

Version

5.0.5

Botnet

Venom Clients

C2

127.0.0.1:4449

127.0.0.1:4140

147.185.221.21:4449

147.185.221.21:4140
Mutex

Venom_RAT_HVNC_Mutex_Venom RAT_HVNC

Attributes
  • delay

    1

  • install

    true

  • install_file

    SpotifyICL.exe

  • install_folder

    %AppData%

aes.plain

Signatures

  • Async RAT payload 1 IoCs
    rat
  • Asyncrat family
    asyncrat
  • Unsigned PE 1 IoCs

    Checks for missing Authenticode signature.

Files

  • SpotifyPatch.exe
    .exe windows:4 windows x86 arch:x86

    f34d5f2d4577ed6d9ceec516c1f5a744


    Headers

    Imports

    Sections