General

  • Target

    9faf470f679f9b6c8aceba42a94aa9196570df2a3988540c8becdbe160885637.exe

  • Size

    173KB

  • Sample

    241117-kgjseazncq

  • MD5

    e6317314d7f07e51c82ff542b100a746

  • SHA1

    6375b769b95da80d7603be104a22a5fe2c82d914

  • SHA256

    9faf470f679f9b6c8aceba42a94aa9196570df2a3988540c8becdbe160885637

  • SHA512

    6554cadf2b5d70a1d8a2b397a2ce36a02071298a419384d4b3b65a8c62648a5e1f961d72d57511477342728f32aa7ffc67e9783927eadecbcda7a4f0af68834b

  • SSDEEP

    3072:mTblwufSK/kgvh66vLQqGclZdqBWHBkFRwqNwId6Hrwb1NTvD:mmaMMQUdqBWhkMqNUrwb/

Malware Config

Extracted

Family

asyncrat

Version

5.0.5

Botnet

Venom Clients

C2

87.120.127.32:1339

Mutex

Venom_RAT_HVNC_Mutex_Venom RAT_HVNC

Attributes
  • delay

    1

  • install

    true

  • install_file

    vchost.exe

  • install_folder

    %AppData%

aes.plain

Targets

    • Target

      9faf470f679f9b6c8aceba42a94aa9196570df2a3988540c8becdbe160885637.exe

    • Size

      173KB

    • MD5

      e6317314d7f07e51c82ff542b100a746

    • SHA1

      6375b769b95da80d7603be104a22a5fe2c82d914

    • SHA256

      9faf470f679f9b6c8aceba42a94aa9196570df2a3988540c8becdbe160885637

    • SHA512

      6554cadf2b5d70a1d8a2b397a2ce36a02071298a419384d4b3b65a8c62648a5e1f961d72d57511477342728f32aa7ffc67e9783927eadecbcda7a4f0af68834b

    • SSDEEP

      3072:mTblwufSK/kgvh66vLQqGclZdqBWHBkFRwqNwId6Hrwb1NTvD:mmaMMQUdqBWhkMqNUrwb/

    • AsyncRat

      AsyncRAT is designed to remotely monitor and control other computers written in C#.

    • Asyncrat family

    • Async RAT payload

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

MITRE ATT&CK Enterprise v15

Tasks