Overview

overview

10

Static

static

3

Rose_1_1_4_2.zip

windows7-x64

10

Rose_1_1_4_2.zip

windows10-2004-x64

1

Rose_1_1_4...nu.dll

windows7-x64

1

Rose_1_1_4...nu.dll

windows10-2004-x64

1

Rose_1_1_4...or.exe

windows7-x64

10

Rose_1_1_4...or.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    Rose_1_1_4_2.zip

  • Size

    16.1MB

  • Sample

    241028-yfna4atkhl

  • MD5

    6b27604d6f445bce6ad546885c0c0949

  • SHA1

    75967d80043852f69bfc858675298b8fa1da12a9

  • SHA256

    3af2d8280ca274b2d5d06e2494a7e99ba1b26c439e426335bf98c1eb640e38fc

  • SHA512

    e71d31fdefb7b77787f12ea6a5a712240b3d1146c2e7d9212877a83f8a69cb7509b8bc5928674cfb45f125c721f61f6cc9d30ff588e66bbbf77abcf02cc1d97d

  • SSDEEP

    393216:iON95GDgNyOMiyGFty4riUG4/Hv73BwVa6w:iakM4GrjvbBwVa6w

Score
10/10
asyncratsazanrat

Malware Config

Extracted

Family

asyncrat

Version

Venom RAT + HVNC + Stealer + Grabber v6.0.3

Botnet

sazan

Mutex

rdzbojdvoiqafvcuqj

Attributes
  • delay

    1

  • install

    false

  • install_folder

    %AppData%

  • pastebin_config

    https://pastebin.ai/raw/it4zrvblz1

aes.plain

Targets

    • Target

      Rose_1_1_4_2.zip

    • Size

      16.1MB

    • MD5

      6b27604d6f445bce6ad546885c0c0949

    • SHA1

      75967d80043852f69bfc858675298b8fa1da12a9

    • SHA256

      3af2d8280ca274b2d5d06e2494a7e99ba1b26c439e426335bf98c1eb640e38fc

    • SHA512

      e71d31fdefb7b77787f12ea6a5a712240b3d1146c2e7d9212877a83f8a69cb7509b8bc5928674cfb45f125c721f61f6cc9d30ff588e66bbbf77abcf02cc1d97d

    • SSDEEP

      393216:iON95GDgNyOMiyGFty4riUG4/Hv73BwVa6w:iakM4GrjvbBwVa6w

    Score
    10/10
    asyncratsazanrat

    • AsyncRat

      AsyncRAT is designed to remotely monitor and control other computers written in C#.

      ratasyncrat

    • Asyncrat family

      asyncrat

    • Async RAT payload

      rat

    • Executes dropped EXE

    • Loads dropped DLL

    behavioral1behavioral2

    • Target

      Rose_1_1_4_2/RoseMenu.dll

    • Size

      16.4MB

    • MD5

      9deda25d3baa4bbdca594d18b6ea6dd3

    • SHA1

      38b579e0b4f2bbe2dcc62be109f27be69db3e36d

    • SHA256

      954c732de31546b562861c6ba89abb7a87e6e7f53410ca990e76703ab24c96da

    • SHA512

      664959d61fb86e81ed8f08871f6205a56eb8be046cd965ed4b2bfaea021b14b241edd9eebbd03cd93be5422fd85bbecaa624bee006abfaeeb1b8e20653a2cb44

    • SSDEEP

      393216:l1T7MZmPWy4U0uVTsILiQ8MN5xFrVfW3p:3oUuSLPF5fW3

    Score
    1/10
    behavioral3behavioral4

    • Target

      Rose_1_1_4_2/Rose_İnjector.exe

    • Size

      108KB

    • MD5

      17f7206a7e2535c2757a2e28af6c13c8

    • SHA1

      5cea3e60c35b8da9e1520832071ca52b98991797

    • SHA256

      8f1d00324051a90eb2ca14d2d68946b78d89e36ed3ce9082af05da5b38c04457

    • SHA512

      15c3ea73fd01290171448f0e0dea4a3b2919448c35116d9bcce99f6e81be063ba6fccef7ec1b71fcce3056c15f0099130d21edd5372fb7f46cfcae5f7c2dec39

    • SSDEEP

      1536:eztgRnOxvwiHj+4c4ajjlKINra4Op/XiCwVjq0CHKX9xB:ez6O2iqKCjjm1/Xi34HKX9L

    Score
    10/10
    asyncratsazanrat

    • AsyncRat

      AsyncRAT is designed to remotely monitor and control other computers written in C#.

      ratasyncrat

    • Asyncrat family

      asyncrat

    • Async RAT payload

      rat

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Loads dropped DLL

    behavioral5behavioral6

MITRE ATT&CK Enterprise v15

Tasks