Analysis
-
max time kernel
94s -
max time network
149s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
-
submitted
27-11-2024 22:03
General
-
Target
AWP.GG.exe
-
Size
63KB
-
MD5
090fb6a455841538572f28e65abe87ad
-
SHA1
b33bb39ecdf6216f2eb0490a1e8b0e6f9d051f56
-
SHA256
f2f9488bf82e70695cc3a8e25e64681bcd057ccdf43aa5187a53f05f33f5c9fb
-
SHA512
703e2bbb8819554de3f47eba85d1c3d42ebb6061a61bc5dc4314ad8ba579786b59996df1beaf0e358fb6f6987c1e238e9b2ea91030552558541a57c47cf3fe56
-
SSDEEP
1536:YhIBLTM3Ufc0cMdQc78dgEmxwbbkwYFG+DpqKmY7:YhIBLTM3Ufc6dD7cywbbkFpgz
Score
10/10
Malware Config
Extracted
Family
asyncrat
Version
5.0.5
Botnet
Venom Clients
C2
but-directive.gl.at.ply.gg:9840
Mutex
Venom_RAT_HVNC_Mutex_Venom RAT_HVNC
Attributes
-
delay
1
-
install
false
-
install_folder
%AppData%
aes.plain
Signatures
-
AsyncRat
AsyncRAT is designed to remotely monitor and control other computers written in C#.
-
Asyncrat family
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\AWP.GG.exe"C:\Users\Admin\AppData\Local\Temp\AWP.GG.exe"1⤵
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
8KB
-
Filesize
88KB
-
Filesize
10.8MB
-
Filesize
10.8MB
-
Filesize
8KB
-
Filesize
10.8MB
-
Filesize
10.8MB