General

  • Target

    Client.exe

  • Size

    74KB

  • Sample

    241216-th496svqdl

  • MD5

    ff9957be040ba821afc9248d7f3c9e74

  • SHA1

    19bf5b47a05a06f8c448286979c17364df9b9d8a

  • SHA256

    f0de46c374e87a43f8e8d977ed7920271beb883f0cc19492698301ea412498e5

  • SHA512

    2b283049ffaecb665006453bf5757ea7adc95a678ded145285bf8529a824a1ec10d1e92c319553d436d4aea4e665fe995db6748a22fa72898faf8adbeef17703

  • SSDEEP

    1536:SUaAcx2l/Cx2PMVie9VdQuDI6H1bf/3EQzcuLVclN:SUDcx2Bq2PMVie9VdQsH1bffEQnBY

Malware Config

Extracted

Family

asyncrat

Version

Venom RAT + HVNC + Stealer + Grabber v6.0.3

Botnet

Linas

C2

127.0.0.1:4449

185.241.61.180:4449

Mutex

lxvckrzncz

Attributes
  • delay

    1

  • install

    true

  • install_file

    Defender.exe

  • install_folder

    %AppData%

aes.plain

Targets

    • Target

      Client.exe

    • Size

      74KB

    • MD5

      ff9957be040ba821afc9248d7f3c9e74

    • SHA1

      19bf5b47a05a06f8c448286979c17364df9b9d8a

    • SHA256

      f0de46c374e87a43f8e8d977ed7920271beb883f0cc19492698301ea412498e5

    • SHA512

      2b283049ffaecb665006453bf5757ea7adc95a678ded145285bf8529a824a1ec10d1e92c319553d436d4aea4e665fe995db6748a22fa72898faf8adbeef17703

    • SSDEEP

      1536:SUaAcx2l/Cx2PMVie9VdQuDI6H1bf/3EQzcuLVclN:SUDcx2Bq2PMVie9VdQsH1bffEQnBY

    • AsyncRat

      AsyncRAT is designed to remotely monitor and control other computers written in C#.

    • Asyncrat family

    • VenomRAT

      Detects VenomRAT.

    • Venomrat family

    • Async RAT payload

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

MITRE ATT&CK Enterprise v15

Tasks