Overview

overview

10

Static

static

1

URLScan

urlscan

1

https://t.me/RELabDi...

windows11-21h2-x64

10

Resubmissions

24-12-2024 00:51

241224-a7m8eawrhs 10

24-12-2024 00:42

241224-a2skyawqdy 8

Sharing

Copy URL
Twitter E-mail

General

  • Target

    https://t.me/RELabDiscussion/30886

  • Sample

    241224-a7m8eawrhs

Score
10/10
asyncratdefaultdefense_evasiondiscoveryevasionratthemidatrojan

Malware Config

Extracted

Family

asyncrat

Version

Venom RAT + HVNC + Stealer + Grabber v6.0.3

Botnet

Default

C2

127.0.0.1:4449

Mutex

ndlahlengmipmdcv

Attributes
  • delay

    1

  • install

    false

  • install_folder

    %AppData%

aes.plain

Targets

    • Target

      https://t.me/RELabDiscussion/30886

    Score
    10/10
    asyncratdefaultdefense_evasiondiscoveryevasionratthemidatrojan

    • AsyncRat

      AsyncRAT is designed to remotely monitor and control other computers written in C#.

      ratasyncrat

    • Asyncrat family

      asyncrat

    • Identifies VirtualBox via ACPI registry values (likely anti-VM)

      evasion

    • Downloads MZ/PE file

    • Checks BIOS information in registry

      BIOS information is often read in order to detect sandboxing environments.

    • Executes dropped EXE

    • Loads dropped DLL

    • Themida packer

      Detects Themida, an advanced Windows software protection system.

      themida

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

      discovery

    • Checks whether UAC is enabled

      evasiontrojan

    • Drops desktop.ini file(s)

    • Suspicious use of NtSetInformationThreadHideFromDebugger

    behavioral1

MITRE ATT&CK Enterprise v15

Tasks