General
-
Target
rbot.exe
-
Size
74KB
-
Sample
241223-gx15vaxkcm
-
MD5
d3e25ac19ab764cb87aef7ce67421529
-
SHA1
57b7b67bb36dfc5fd0cc7dc2475acb89b6038a51
-
SHA256
9ea1287b00a370153de5ee5ba19bf568a9b55b63ac4da4ac8ec755eb8c8e3ca5
-
SHA512
394dce23cebdfaf889c643848093d4b21eb1cbcd108560a39241d796891ef4015b31e86f6f6b9525bd5f6f1856e55d3d7384ae5f07188ce5326d4e5077c56d20
-
SSDEEP
1536:LUk0cxVGlCBiPMVye9VdQuDI6H1bf/Q52+QdQzc+LVclN:LURcxVMWiPMVye9VdQsH1bfI5sQXBY
Behavioral task
behavioral1
Sample
rbot.exe
Resource
win7-20240903-en
Malware Config
Extracted
asyncrat
Venom RAT + HVNC + Stealer + Grabber v6.0.3
Default
luiijmnzfd
-
delay
1
-
install
false
-
install_folder
%AppData%
-
pastebin_config
https://pastebin.com/raw/RdDXA3cD
Targets
-
-
Target
rbot.exe
-
Size
74KB
-
MD5
d3e25ac19ab764cb87aef7ce67421529
-
SHA1
57b7b67bb36dfc5fd0cc7dc2475acb89b6038a51
-
SHA256
9ea1287b00a370153de5ee5ba19bf568a9b55b63ac4da4ac8ec755eb8c8e3ca5
-
SHA512
394dce23cebdfaf889c643848093d4b21eb1cbcd108560a39241d796891ef4015b31e86f6f6b9525bd5f6f1856e55d3d7384ae5f07188ce5326d4e5077c56d20
-
SSDEEP
1536:LUk0cxVGlCBiPMVye9VdQuDI6H1bf/Q52+QdQzc+LVclN:LURcxVMWiPMVye9VdQsH1bfI5sQXBY
-
Asyncrat family
-
Venomrat family
-
Checks installed software on the system
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Legitimate hosting services abused for malware hosting/C2
-