General

  • Target

    AimAssist.exe

  • Size

    74KB

  • Sample

    241201-z9lvssslgz

  • MD5

    652d8971b1de9ac91d9dc53150a83a6f

  • SHA1

    f58b1ba78665d08a52d355ba626fa8d2a72d8f19

  • SHA256

    df6a38e3658e607ca005881650480cb7485dce3fa1d9480a25b8858c17bcc509

  • SHA512

    4047192ec25582eca08e58b316694135054ba41de91df1d914f9565acc773b9bde7d0a426d70a878a7ea13720707fe462f73ad5fcd829322cd5edc312f3ae7d4

  • SSDEEP

    1536:hUOgcxLVNCBWPMVWSIIcH1bi/NWQQzcSLVclN:hUfcxLfaWPMVWSOH1bilbQDBY

Malware Config

Extracted

Family

asyncrat

Version

Venom RAT + HVNC + Stealer + Grabber v6.0.3

Botnet

Default

C2

147.185.221.225:54312

Mutex

dzhpquvlshqpbv

Attributes
  • delay

    1

  • install

    true

  • install_file

    Programs.exe

  • install_folder

    %AppData%

aes.plain

Targets

    • Target

      AimAssist.exe

    • Size

      74KB

    • MD5

      652d8971b1de9ac91d9dc53150a83a6f

    • SHA1

      f58b1ba78665d08a52d355ba626fa8d2a72d8f19

    • SHA256

      df6a38e3658e607ca005881650480cb7485dce3fa1d9480a25b8858c17bcc509

    • SHA512

      4047192ec25582eca08e58b316694135054ba41de91df1d914f9565acc773b9bde7d0a426d70a878a7ea13720707fe462f73ad5fcd829322cd5edc312f3ae7d4

    • SSDEEP

      1536:hUOgcxLVNCBWPMVWSIIcH1bi/NWQQzcSLVclN:hUfcxLfaWPMVWSOH1bilbQDBY

    • AsyncRat

      AsyncRAT is designed to remotely monitor and control other computers written in C#.

    • Asyncrat family

    • VenomRAT

      Detects VenomRAT.

    • Venomrat family

    • Async RAT payload

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

MITRE ATT&CK Enterprise v15

Tasks