General
-
Target
Nova.rar
-
Size
2.1MB
-
Sample
241124-xknlzstncs
-
MD5
50ee1cf21948c6015354e9c1a94ca5db
-
SHA1
f2f6fb19a2db75d2d5515fd3a20c66eb8f3e6d42
-
SHA256
8fe639c3cbdcb49a5246f85ce136f14c8c0ad5150c6e38b5eb66eced9d4c4329
-
SHA512
46c8a6e2818972ec363b5905838e05828a87b10c7991ae5124c485ccf625da0cff4985d675bbda08a9eccf1fc1027c5db0a22f8e99c732f7593f66c68f3654dc
-
SSDEEP
49152:OWYU2F4Tu9YiDuTnlvraYTi04JIBv1WteMcP+1HFFNFwAAnv4qy+d:ZYLCiDuDluYe0cUwp31bN1Aj
Static task
static1
Behavioral task
behavioral1
Sample
Nova.rar
Resource
win10ltsc2021-20241023-en
Malware Config
Extracted
asyncrat
Venom RAT + HVNC + Stealer + Grabber v6.0.3
Default
193.161.193.99:53757
hsaurcrgqwhjimnkbht
-
delay
1
-
install
true
-
install_file
Load.exe
-
install_folder
%AppData%
Targets
-
-
Target
Nova.rar
-
Size
2.1MB
-
MD5
50ee1cf21948c6015354e9c1a94ca5db
-
SHA1
f2f6fb19a2db75d2d5515fd3a20c66eb8f3e6d42
-
SHA256
8fe639c3cbdcb49a5246f85ce136f14c8c0ad5150c6e38b5eb66eced9d4c4329
-
SHA512
46c8a6e2818972ec363b5905838e05828a87b10c7991ae5124c485ccf625da0cff4985d675bbda08a9eccf1fc1027c5db0a22f8e99c732f7593f66c68f3654dc
-
SSDEEP
49152:OWYU2F4Tu9YiDuTnlvraYTi04JIBv1WteMcP+1HFFNFwAAnv4qy+d:ZYLCiDuDluYe0cUwp31bN1Aj
-
Asyncrat family
-
Xmrig family
-
Async RAT payload
-
XMRig Miner payload
-
Command and Scripting Interpreter: PowerShell
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
-
Creates new service(s)
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE
-
Power Settings
powercfg controls all configurable power system settings on a Windows system and can be abused to prevent an infected host from locking or shutting down.
-
Drops file in System32 directory
-
Suspicious use of SetThreadContext
-
MITRE ATT&CK Enterprise v15
Execution
Command and Scripting Interpreter
1PowerShell
1Scheduled Task/Job
1Scheduled Task
1System Services
2Service Execution
2Persistence
Create or Modify System Process
2Windows Service
2Power Settings
1Scheduled Task/Job
1Scheduled Task
1