Behavioral task
behavioral1
Sample
Coffee.exe
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
Coffee.exe
Resource
win10v2004-20241007-en
General
-
Target
59cbd215-76ea-434d-93ca-4d6aec3bac98-free-coffee.zip
-
Size
29KB
-
MD5
73f0f77181e1f06a9dbc41ea9e7a03fe
-
SHA1
c895f4a970c612bc51e0fc272c3f08283a13d34f
-
SHA256
6f33ae4bf134c49faa14517a275c039ca1818b24fc2304649869e399ab2fb389
-
SHA512
160eb2d80abc6911f435df2a69a1aa8914f3fdd56ea6399e31a5fd382a676bb734fbfb93cd0abb0f3b85e9af1847b13a440430b054a3465c349d7423da6ce4e3
-
SSDEEP
768:r156abAwxg69ZrAaZ8pwXPsCKknfspW252v/:J5Xb5n3AaZACLf+2H
Malware Config
Extracted
asyncrat
5.0.5
Venom Clients
127.0.0.1:3451
37.120.233.226:3451
Venom_RAT_HVNC_Mutex_Venom RAT_HVNC
-
delay
1
-
install
false
-
install_folder
%AppData%
Signatures
Files
-
59cbd215-76ea-434d-93ca-4d6aec3bac98-free-coffee.zip.zip
Password: infected
-
Coffee.exe.exe windows:4 windows x86 arch:x86
f34d5f2d4577ed6d9ceec516c1f5a744
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
Imports
mscoree
_CorExeMain
Sections
.text Size: 58KB - Virtual size: 58KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 4KB - Virtual size: 3KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ