General

  • Target

    listenlittlenigger.exe

  • Size

    6.7MB

  • Sample

    241129-zqk46azqaj

  • MD5

    42bd70076cbd6bf784ab995852146824

  • SHA1

    e0f1e831775736e856f5325f546c3638f6112775

  • SHA256

    b89c8fb7d60e1ad1593a0f8f71f0ff8627f4cd7cdca0ad816cf88f17e36fa159

  • SHA512

    61b4a3e526e84280df3a26b2d8e7cef969dd45f32f6e857f62e9e2b01b355d22da9430807ab1515b2a4be6c7ef2d4b5520d2c3cc8a5c0152595b9a91c3c38f54

  • SSDEEP

    196608:QsjpAN/kWDGXtGzICteEroxzlxZV3Gu5D4S26/CS3HxTM9:Jj6buGzInErot14S26nxY9

Malware Config

Extracted

Family

asyncrat

Version

Venom RAT + HVNC + Stealer + Grabber v6.0.3

Botnet

Default

C2

127.0.0.1:11162

Mutex

kqfpdrtqyhcytvu

Attributes
  • delay

    1

  • install

    false

  • install_folder

    %AppData%

aes.plain

Targets

    • Target

      listenlittlenigger.exe

    • Size

      6.7MB

    • MD5

      42bd70076cbd6bf784ab995852146824

    • SHA1

      e0f1e831775736e856f5325f546c3638f6112775

    • SHA256

      b89c8fb7d60e1ad1593a0f8f71f0ff8627f4cd7cdca0ad816cf88f17e36fa159

    • SHA512

      61b4a3e526e84280df3a26b2d8e7cef969dd45f32f6e857f62e9e2b01b355d22da9430807ab1515b2a4be6c7ef2d4b5520d2c3cc8a5c0152595b9a91c3c38f54

    • SSDEEP

      196608:QsjpAN/kWDGXtGzICteEroxzlxZV3Gu5D4S26/CS3HxTM9:Jj6buGzInErot14S26nxY9

    • AsyncRat

      AsyncRAT is designed to remotely monitor and control other computers written in C#.

    • Asyncrat family

    • VenomRAT

      Detects VenomRAT.

    • Venomrat family

    • Async RAT payload

    • Executes dropped EXE

    • Loads dropped DLL

    • Adds Run key to start application

    • Drops file in System32 directory

MITRE ATT&CK Enterprise v15

Tasks