General
-
Target
Loader.zip
-
Size
2.1MB
-
Sample
241217-ynkvyaxlhk
-
MD5
eac7fe177734fad674dd89e3db205aaa
-
SHA1
7cb4e2a116c9186d27964dfe19bc60bd3e48393d
-
SHA256
c92ea83f50af7717023de2d09b5a1d6e7975d9faf7d9758100d80b23946016d3
-
SHA512
fb85fc58af4c07257dae9b9e256d590fa2cc6e4d0978922e7e1a71c236e64496941e9fb0fde0b94d34ef037258b2ffc5a6604435a89d19b6ed1fcd0793834352
-
SSDEEP
49152:dcwa4DKh+xntUEA5LHPF+LdOEY6h97TVlCd9hauQTmHfLbBXgH:dcwa4DKMAlPGbHh97owLKH32
Static task
static1
Behavioral task
behavioral1
Sample
Loader.zip
Resource
win7-20240903-en
Malware Config
Extracted
asyncrat
Venom RAT + HVNC + Stealer + Grabber v6.0.3
Default
193.161.193.99:53757
hsaurcrgqwhjimnkbht
-
delay
1
-
install
true
-
install_file
Load.exe
-
install_folder
%AppData%
Targets
-
-
Target
Loader.zip
-
Size
2.1MB
-
MD5
eac7fe177734fad674dd89e3db205aaa
-
SHA1
7cb4e2a116c9186d27964dfe19bc60bd3e48393d
-
SHA256
c92ea83f50af7717023de2d09b5a1d6e7975d9faf7d9758100d80b23946016d3
-
SHA512
fb85fc58af4c07257dae9b9e256d590fa2cc6e4d0978922e7e1a71c236e64496941e9fb0fde0b94d34ef037258b2ffc5a6604435a89d19b6ed1fcd0793834352
-
SSDEEP
49152:dcwa4DKh+xntUEA5LHPF+LdOEY6h97TVlCd9hauQTmHfLbBXgH:dcwa4DKMAlPGbHh97owLKH32
-
Asyncrat family
-
Xmrig family
-
Async RAT payload
-
XMRig Miner payload
-
Command and Scripting Interpreter: PowerShell
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
-
Creates new service(s)
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Drops startup file
-
Executes dropped EXE
-
Loads dropped DLL
-
Power Settings
powercfg controls all configurable power system settings on a Windows system and can be abused to prevent an infected host from locking or shutting down.
-
Drops file in System32 directory
-
Suspicious use of SetThreadContext
-
MITRE ATT&CK Enterprise v15
Execution
Command and Scripting Interpreter
1PowerShell
1Scheduled Task/Job
1Scheduled Task
1System Services
2Service Execution
2Persistence
Create or Modify System Process
2Windows Service
2Power Settings
1Scheduled Task/Job
1Scheduled Task
1Privilege Escalation
Create or Modify System Process
2Windows Service
2Scheduled Task/Job
1Scheduled Task
1