Overview

overview

10

Static

static

10

Client.exe

windows7-x64

10

Client.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    Client.exe

  • Size

    73KB

  • Sample

    241227-ffbcesskfm

  • MD5

    f5f6281bdd8312649df47aa5ff51817b

  • SHA1

    7dbfee0746f5fff27fe4aef4689655bb95ceec9b

  • SHA256

    c01d9f0b0e36df6209dd32216dc5c23732de1ee7c8c5d94532216d1725573ba5

  • SHA512

    5789255bd6d9252fff6b9aa4a3d83f8de3f75f289a1829678b6f425811491b1c6ff749600e5e115e3635105106307a41041aedbaa5bb10e4a7b998440b3fe9b0

  • SSDEEP

    1536:YUN8cxQFvCr6PMVWe9VdQkhDIyH1bf/lOQzcX3VclN:YUOcxQxs6PMVWe9VdQgH1bfNOQilY

Score
10/10
asyncratvenomratdefaultrat

Malware Config

Extracted

Family

asyncrat

Version

Venom RAT + HVNC + Stealer + Grabber v6.0.3

Botnet

Default

Mutex

homiplaglliddnwuc

Attributes
  • delay

    1

  • install

    true

  • install_file

    Adobe Updater.exe

  • install_folder

    %AppData%

  • pastebin_config

    https://pastebin.com/raw/8haaGvJp

aes.plain

Targets

    • Target

      Client.exe

    • Size

      73KB

    • MD5

      f5f6281bdd8312649df47aa5ff51817b

    • SHA1

      7dbfee0746f5fff27fe4aef4689655bb95ceec9b

    • SHA256

      c01d9f0b0e36df6209dd32216dc5c23732de1ee7c8c5d94532216d1725573ba5

    • SHA512

      5789255bd6d9252fff6b9aa4a3d83f8de3f75f289a1829678b6f425811491b1c6ff749600e5e115e3635105106307a41041aedbaa5bb10e4a7b998440b3fe9b0

    • SSDEEP

      1536:YUN8cxQFvCr6PMVWe9VdQkhDIyH1bf/lOQzcX3VclN:YUOcxQxs6PMVWe9VdQgH1bfNOQilY

    Score
    10/10
    asyncratvenomratdefaultrat

    • AsyncRat

      AsyncRAT is designed to remotely monitor and control other computers written in C#.

      ratasyncrat

    • Asyncrat family

      asyncrat

    • VenomRAT

      Detects VenomRAT.

      rat

    • Venomrat family

      venomrat

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Loads dropped DLL

    • Legitimate hosting services abused for malware hosting/C2

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks