General
-
Target
AimAssist.exe
-
Size
74KB
-
Sample
241201-z9lvssslgz
-
MD5
652d8971b1de9ac91d9dc53150a83a6f
-
SHA1
f58b1ba78665d08a52d355ba626fa8d2a72d8f19
-
SHA256
df6a38e3658e607ca005881650480cb7485dce3fa1d9480a25b8858c17bcc509
-
SHA512
4047192ec25582eca08e58b316694135054ba41de91df1d914f9565acc773b9bde7d0a426d70a878a7ea13720707fe462f73ad5fcd829322cd5edc312f3ae7d4
-
SSDEEP
1536:hUOgcxLVNCBWPMVWSIIcH1bi/NWQQzcSLVclN:hUfcxLfaWPMVWSOH1bilbQDBY
Behavioral task
behavioral1
Sample
AimAssist.exe
Resource
win7-20240903-en
Malware Config
Extracted
asyncrat
Venom RAT + HVNC + Stealer + Grabber v6.0.3
Default
147.185.221.225:54312
dzhpquvlshqpbv
-
delay
1
-
install
true
-
install_file
Programs.exe
-
install_folder
%AppData%
Targets
-
-
Target
AimAssist.exe
-
Size
74KB
-
MD5
652d8971b1de9ac91d9dc53150a83a6f
-
SHA1
f58b1ba78665d08a52d355ba626fa8d2a72d8f19
-
SHA256
df6a38e3658e607ca005881650480cb7485dce3fa1d9480a25b8858c17bcc509
-
SHA512
4047192ec25582eca08e58b316694135054ba41de91df1d914f9565acc773b9bde7d0a426d70a878a7ea13720707fe462f73ad5fcd829322cd5edc312f3ae7d4
-
SSDEEP
1536:hUOgcxLVNCBWPMVWSIIcH1bi/NWQQzcSLVclN:hUfcxLfaWPMVWSOH1bilbQDBY
-
Asyncrat family
-
Venomrat family
-
Async RAT payload
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE
-