Overview

overview

10

Static

static

10

VenomRAT v...re.dll

windows11-21h2-x64

1

VenomRAT v...re.dll

windows11-21h2-x64

1

VenomRAT v...rt.dll

windows11-21h2-x64

1

VenomRAT v...re.dll

windows11-21h2-x64

1

VenomRAT v...re.dll

windows11-21h2-x64

1

VenomRAT v....1.dll

windows11-21h2-x64

1

VenomRAT v...UI.dll

windows11-21h2-x64

1

VenomRAT v....2.dll

windows11-21h2-x64

1

VenomRAT v...er.exe

windows11-21h2-x64

1

VenomRAT v...or.vbs

windows11-21h2-x64

1

VenomRAT v...er.vbs

windows11-21h2-x64

1

VenomRAT v...ods.js

windows11-21h2-x64

3

VenomRAT v...per.js

windows11-21h2-x64

3

VenomRAT v...ker.js

windows11-21h2-x64

3

VenomRAT v...em.vbs

windows11-21h2-x64

1

VenomRAT v...ify.js

windows11-21h2-x64

3

VenomRAT v...Box.js

windows11-21h2-x64

3

VenomRAT v...ms.vbs

windows11-21h2-x64

1

VenomRAT v...gs.vbs

windows11-21h2-x64

1

VenomRAT v...ec.vbs

windows11-21h2-x64

1

VenomRAT v...ny.exe

windows11-21h2-x64

10

VenomRAT v...64.exe

windows11-21h2-x64

10

VenomRAT v...86.exe

windows11-21h2-x64

10

VenomRAT v...on.dll

windows11-21h2-x64

1

VenomRAT v...ls.dll

windows11-21h2-x64

3

VenomRAT v....3.exe

windows11-21h2-x64

10

VenomRAT v...ib.dll

windows11-21h2-x64

1

VenomRAT v...Ip.dll

windows11-21h2-x64

1

VenomRAT v...ib.dll

windows11-21h2-x64

1

VenomRAT v...rd.dll

windows11-21h2-x64

1

VenomRAT v...re.dll

windows11-21h2-x64

1

VenomRAT v...et.dll

windows11-21h2-x64

1

Sharing

Copy URL
Twitter E-mail

General

  • Target

    VenomRAT.v6.0.3.zip

  • Size

    126.5MB

  • Sample

    241230-dwbxsawpdv

  • MD5

    336944ecbdcaa166034d7a7cb529356a

  • SHA1

    116d3cbb026dbcb5a99a31717964cc36d5244c85

  • SHA256

    ccfdb3b7aae8b9f7988244877cda82c24f2560577e1b22a5b56830cacd19ca80

  • SHA512

    324afc5a24a65e31935ba70f16bd35315294a4840a0ffc96f9feb85ecae2fc7d1d72a0df6aa2c502d7463aa1851229ed2c60593c509c64027518bc30519bb8a6

  • SSDEEP

    3145728:3aEVnFM/1+4jkyU3DHYIdvDTHx0GKxr11GOoXYWSyK8h/J:3Q/84jtU3s6H6xrCOoXYvZ8h/J

Score
10/10
asyncratstormkittyxwormdiscoveryexecutionpersistencerattrojan

Malware Config

Extracted

Family

xworm

C2

127.0.0.1:4444

heheyanel.ddns.net:4444
Attributes
  • Install_directory

    %ProgramData%

  • install_file

    Activator.exe

  • telegram

    https://api.telegram.org/bot7427144754:AAHRLM93AsaKo2dFejmZxunuQW0uH41yfn0/sendMessage?chat_id=7294780361

Targets

    • Target

      VenomRAT v6.0.3/DevExpress.RichEdit.v22.1.Core.dll

    • Size

      8.4MB

    • MD5

      7ddf6749688dab11c14e464684346a51

    • SHA1

      dc3578c283b0728052125313f59e71deabe538ab

    • SHA256

      078551cc3b00963dcfae8bcf69f8e926cf67234fc3c688fffccc195b4a611976

    • SHA512

      0087f1e7d85ea050fb860125ed65ca425c6509c23544a776a65a6cdb614d9732f0c99ec2fcbe5c33317053f2df7f839ad420bc2581b898a08c48d183d07d44c6

    • SSDEEP

      98304:HPb+G1Tez+HBpnafYPTW033ZNVMBkxVz6uuRoI196q:MOZ4BaVz6pRoI19v

    Score
    1/10
    behavioral1

    • Target

      VenomRAT v6.0.3/DevExpress.RichEdit.v22.2.Core.dll

    • Size

      8.4MB

    • MD5

      6d473c395d6e89b936421a6df8a10095

    • SHA1

      20f982e5be5f2d42f09713a28b5bff1e2a78dab6

    • SHA256

      aab6a1b65130888dbd2f64be8cf4b43049f4feb28d81e66b9ea62ae379f736b0

    • SHA512

      4c7dde968de3f2fd0e0f811d0917be2a4f96707963306c58a5be583da176726db599c86dbe215b66374659061d96937a0b42c3fec4a8830bf654004dc1672915

    • SSDEEP

      98304:LI/9z6yxQRo97rvhzf/tskSkTSF/ilFWNqeucIldOfio//2:gtvRmqeuxk5/2

    Score
    1/10
    behavioral2

    • Target

      VenomRAT v6.0.3/DevExpress.RichEdit.v22.2.Export.dll

    • Size

      252KB

    • MD5

      c5dee63a484b6097af15bc6c9408d732

    • SHA1

      c39eb387075db45afba15fbeabfd54a297132e77

    • SHA256

      40ec3f329794a78585674306f6645af386d0e0cef7accf6f3ac4b9c4f8511291

    • SHA512

      88c80af1943a7004717907bbfccc3972d486304443dec8566abdafafa044fe074239cb819bf728c755bf28dadd05ca93c9f9d12aeeaf7e265c22d6a1864d1418

    • SSDEEP

      6144:sF8dBOLERSXYvZt7OmdzmO4kpwdSaLFtHASEosefoa:NOLERSXYj732Ezefoa

    Score
    1/10
    behavioral3

    • Target

      VenomRAT v6.0.3/DevExpress.Sparkline.v22.1.Core.dll

    • Size

      87KB

    • MD5

      ba1a701a6312c167ac6f2bf407faa237

    • SHA1

      6d98e694e34daef743e15270b635c3dd19fc3b0f

    • SHA256

      bf03f577ecb257067abee5e7b6e49803a309231701cd07a39caa210d5c886c4c

    • SHA512

      d9b543a7f7c52938965878c9eaf507d0a885f9646fb709a465140f7a9f6cfe8eeaf0618fb3ca716ddf2e98199c3b35551e40d0d963e51b67c3fbe1bea04a05d2

    • SSDEEP

      1536:4hn/UiKYDmlc/foBSGLzyexgEEjKAZxNHumV:4RKcXeSEZglWAZxNHuq

    Score
    1/10
    behavioral4

    • Target

      VenomRAT v6.0.3/DevExpress.Sparkline.v22.2.Core.dll

    • Size

      88KB

    • MD5

      c44b08fc1e03055ade50d0e0cd5d4b8f

    • SHA1

      438c65f3f3eb957c38734a449b6c92b8db0360c1

    • SHA256

      449953a7fb470b18a37c36d321dc61a1c6bed8e039ee8415cc37315ae44f60b0

    • SHA512

      51106b4bdbaa5643aadfdadfb81b4fbd8abde43de8e713b210bc640c838b19946a59a1278dd65b2c809aa77d699dbe85ef276896db8677c469d2a8bcb49e5363

    • SSDEEP

      1536:PJaqAz759G1wgGQyDql4td73FkLcerz6EwuSscrJjixSQDPx8:PJaJ7xgCKcQarNJjixSQrx8

    Score
    1/10
    behavioral5

    • Target

      VenomRAT v6.0.3/DevExpress.Utils.v22.1.dll

    • Size

      20.0MB

    • MD5

      07adc748684fd33a198f2dc6eea12666

    • SHA1

      28f62a05673447a3a347aa6a01ae8cd518126956

    • SHA256

      50cba5304bf0a620c119a610e73f545fee688462860706785db507110739a093

    • SHA512

      893829cb3e1a27e5cbcab9a3b7ef290b1ec74cb21fc46358f2a08a3149d54bd34258046ac47387ad5777d794478230bf2605897e7259ac7a0241dc1272e121ab

    • SSDEEP

      393216:7u1M1d84WAOfraPyyLic2S0eg+/4/vK0CEo:7u1Mw4WAOfraPyyLic2S0Z+/4/vKz

    Score
    1/10
    behavioral6

    • Target

      VenomRAT v6.0.3/DevExpress.Utils.v22.2.UI.dll

    • Size

      383KB

    • MD5

      7f3b7c8fb94ff22372586f53e1a4a043

    • SHA1

      d7a701541016470ad057e766eb43112c4dfd87b3

    • SHA256

      0eb585844ece8f0a3ce37d008723019d90f2f7e0830a2e702415f70e31e7db68

    • SHA512

      15f4ff575d4bb624a484ed32b335bece6e0205a33bad22c80e6fab4ae514e67cb7a9638513a6fbec811e0089c3a8f3575bd656e450a945b66ddaad6f8e155bb6

    • SSDEEP

      6144:vddhmcLt/Zjzp6L/QIGMSZs05X4K6xTsidwbOy+5xIETtDlfllzBIKT:vldF67NGMG4K6xeOy+9tNzBIKT

    Score
    1/10
    behavioral7

    • Target

      VenomRAT v6.0.3/DevExpress.Utils.v22.2.dll

    • Size

      19.4MB

    • MD5

      b7e6bcd420e084e55a03a92a0e1d4730

    • SHA1

      f64988f40fa0354edf6d64fe2370632a91327e2d

    • SHA256

      41d5ffec69488e985e7e73865693109155f09d72c7c830d2bdad21c2815ada7f

    • SHA512

      de6b4a45602cd95fea349a80027ea8fd1c62e939d8e1d0bf2af2de40452a8e5c0c054e9ca787d1cb640e812c4de8cdb8fef14aff978e73071e7d4f6e9ef3778f

    • SSDEEP

      393216:WFK0ZYdVE7IQWAOfraP87Xxe8okEghkDYqglQK:WFK0ZYdVWWAOfraP87Xxe8ok7hkDYqgt

    Score
    1/10
    behavioral8

    • Target

      VenomRAT v6.0.3/DevExpress.WinRTPresenter.Launcher.exe

    • Size

      13KB

    • MD5

      de4449ac523ac31f66efe7f090360f71

    • SHA1

      de7fcb8c16c7cab8255b8e31781efb0ffc45acce

    • SHA256

      76a868948e5b4df73f5dab5606135f6bf10b598bdaa991737224edcb8fdd58db

    • SHA512

      d43021c5878f08c38264e1882313959aa51b8dabf6649a64f476f3e7c0ba7fdaaac0f3edaa6fb3ea2e56889a5e78791236c1dfe8dbcd9218d7eab30a9ee4a56c

    • SSDEEP

      192:CWOsh9lqaOG7Uuri11x9OFzACQS5y2VL:rOsZTVrYTORDQ7y

    Score
    1/10
    behavioral9

    • Target

      VenomRAT v6.0.3/Source Code/Helper/HexEditor/HexEditor.cs

    • Size

      21KB

    • MD5

      cd18a43b44249988a5711881c01f9b67

    • SHA1

      d90f8a311f418de9fde16780156af2f131e49d4e

    • SHA256

      b2eedb670df92310be95b39db447e4d4f13c0c14f87074559111f70436eea686

    • SHA512

      811a010a8363da708be918f618b795e35fd60ad0181f5748ad377393d5ad995904884af46eba2e3a0db3edbc0dd036893f777821bcb0f2f4f63eeedd8d8c8890

    • SSDEEP

      384:YfdtGsfO7mUSEWu8TmaAj7vDZT5G/8nJhikPneNANmyj2whM43EFtM0FHr5oCrhE:kMsfO7mUSEWu8TmaAj7vDZtuehikPneA

    Score
    1/10
    behavioral10

    • Target

      VenomRAT v6.0.3/Source Code/Helper/ListViewColumnSorter.cs

    • Size

      1KB

    • MD5

      580db2008a0de5ad84c7e56c8110c68b

    • SHA1

      d1247f3a48668246f3e46823ca0920f9a378abe3

    • SHA256

      4c6e9fb8539ca679eecdc2a7d32e389618858acd28da168f83a327c39cfecb8a

    • SHA512

      f230075636478394c2fa77e7d770031ec33c6513fc6fc28d2c83bc23e49841308889f1d666253613c9f745dd399bee9ab1334ca8b99eba5b3df09dc67a822b84

    Score
    1/10
    behavioral11

    • Target

      VenomRAT v6.0.3/Source Code/Helper/Methods.cs

    • Size

      3KB

    • MD5

      f84f52f25d00d1cf44af02271fc657cc

    • SHA1

      fdd6c07145f0c0a02403f7669cdc1dcbdcf1c829

    • SHA256

      60a74326857ed25e0c95ed258831f6b0d7298e502f75bbf5c67d5d8c519751a3

    • SHA512

      8d31e93e91d5035356d5983081c7aff4e6c86e10f503f11ccbebac6bf10035bb3ee0b4a748a16ae022fa810eee8ee8ea282dde7cc084577109c1bb7671f7d870

    Score
    3/10
    execution
    behavioral12

    • Target

      VenomRAT v6.0.3/Source Code/Helper/RegistryKeyHelper.cs

    • Size

      3KB

    • MD5

      e899b2e55a077821b065d7c37b69be73

    • SHA1

      576b724dac36426c45e8fbc185c3defb6fd8da5b

    • SHA256

      43e55b01c8ab6f7076e0846daf9f2174bd1ec1f2c49df862ed093b94c71cd80f

    • SHA512

      ee3a81eaacc5d321e68f15935dcacb1552afe8955cf0230ae9bf5eba8450b2079263968dd70bdee5d68c1bd617060cabdbeca619ecce281f3f0b6bb7fca9a6d3

    Score
    3/10
    execution
    behavioral13

    • Target

      VenomRAT v6.0.3/Source Code/Helper/RegistrySeeker.cs

    • Size

      4KB

    • MD5

      371e883334ed081f5460aa48ae81b008

    • SHA1

      c066a4d4b60bf8f09795e642cda63d3b55b83a6d

    • SHA256

      2c4428d31b57758446407ce3d0dcb3c9b45578f9f3c0eace03d3e85572deb9c7

    • SHA512

      eb7e3c65d7610977b6042be8728fab91132e823c2e4ac2fddb1963c9c07c0c18e3b97e7d8e12f0601db3a1ca2548d6cb49b513e30c1105e83dbf9987ee7f8deb

    • SSDEEP

      96:Co4s1yywfRFSnBrJ/FGjUU+W/BfrjiybIVXsYed8QngXZMkgLasSedSQSgSZ0mLK:Yy0ZErJtGjIW/BfrjigtjbgpMkgz1VfX

    Score
    3/10
    execution
    behavioral14

    • Target

      VenomRAT v6.0.3/Source Code/Helper/RegistryValueLstItem.cs

    • Size

      1KB

    • MD5

      93ecf2ea2be1b8c42bde29af788a3c19

    • SHA1

      4dcf98304df2e7090a9e99be30e5d1104d35bfd8

    • SHA256

      5b6232cb07d873994b186eb29c2a671c4574d85fb741eb3425edc8b95947bcad

    • SHA512

      b3d35d91131e9f1150a8bc08a9df00d0baa2517b390d247553521b0f90d5df5c91e5098fc010e3d86c707fd1b4a58734cc8c4e159f70e68311070dbd57ff0f8d

    Score
    1/10
    behavioral15

    • Target

      VenomRAT v6.0.3/Source Code/Helper/TelegramNotify.cs

    • Size

      561B

    • MD5

      e8f7ac632a0e55aaf483454657f9ed94

    • SHA1

      1df19ca081b342596810e916d17109c682ba8e1f

    • SHA256

      7743c6e53e9201b9014d7b7302e258f2cc2421c440c43f2b2c40f51f9a1bea5f

    • SHA512

      b1174a888d8b7dea247db39f1a68a02a1bd4543dc60fb65f432b4d5eda8c7d22df04dab098ff06fc7051b031ac20115a618f51c043a940337843bddb0583e28f

    Score
    3/10
    execution
    behavioral16

    • Target

      VenomRAT v6.0.3/Source Code/Helper/WordTextBox.cs

    • Size

      3KB

    • MD5

      d3acf77b98823554278215a70884c0aa

    • SHA1

      8b3b45cb6dfdc481dc17c1881c754a8ddd661a89

    • SHA256

      d7abef2dbac887746e25eb6fc298bb8514fd41b0db9702023c00269751047c5e

    • SHA512

      b40ba3cd039f8445adcf7f912e1892ff795d8ca47443e9359a156ef6c885f99b07e0e41e3b091cf9b982ad44af27c35f75c8660093fb51c63bfae8cf0646d0d7

    Score
    3/10
    execution
    behavioral17

    • Target

      VenomRAT v6.0.3/Source Code/Params/KeylogParams.cs

    • Size

      1KB

    • MD5

      387028585bc46163e05dfef0d12b8c2b

    • SHA1

      1e2435782ceb9f424e8076415f43b79adcdb3ad5

    • SHA256

      8fbcb22c04c822ca8fdfcfc73530ee86bbdfb3409296e5b7fde2335d49260dcb

    • SHA512

      29e5ff340380acdbedfa867ecddd026f4fb22d2d7926a8ca00220edbc2c22f03c4308428c456f5f60e047e89412e3a2b6ecf0c5dc54ab34496d71630e0c79c5c

    Score
    1/10
    behavioral18

    • Target

      VenomRAT v6.0.3/Source Code/Properties/Settings.cs

    • Size

      6KB

    • MD5

      d5537d6b1c7a3c41fd9a8f1401155de3

    • SHA1

      a8f7f2932c7426c22a7f93df6a3379319183a084

    • SHA256

      2b470ad54977b5667857f20bf06f70a5f0b725290546facbb02027d5f46bec40

    • SHA512

      503cd607052ddb314fdcc1d828e54dfdb8b46fcfb7132099ef7a5cc7daebb48aece82d850c4f6cd64c92a0cb20fa9d10be730d15ac481d9fbeec4f54e6344af0

    • SSDEEP

      192:VGG6gZ060rAlJZltDlN7lRFljwld8l5DlR1lbfAlLGlfXlTGeMpllWlMD1llllGb:VGG6gN0rIJvtRNJR7jYd05RRLbfILWfz

    Score
    1/10
    behavioral19

    • Target

      VenomRAT v6.0.3/Source Code/StreamLibrary/IUnsafeCodec.cs

    • Size

      1KB

    • MD5

      3c8b1c3fc619354a0f5c562debd50912

    • SHA1

      e2dc929102d96381981d54ba9f0a3f0c544720b5

    • SHA256

      fe7a5cf6c9da269cddc00536cfee40e7aaddab8558602db37e2c2bec64eb310a

    • SHA512

      5d5f8ac2d3d4b51511877dad9652b5c2a108ec8c1cb28dd6a3b102c359aeae68d34ccfdd10b73dbd404eb8a994a3a470f1c808f3d8cd249388dfe61c98e619ea

    Score
    1/10
    behavioral20

    • Target

      VenomRAT v6.0.3/Stub/ClientAny.exe

    • Size

      71KB

    • MD5

      958cfc3e7730a66a05d6b8a49ce13d63

    • SHA1

      ebc55f86cccfead463fcc1e6a060a5012fb09907

    • SHA256

      eedce349ce30bae2c269040ac02e0c1d2a979cd2743dc89dc8138e61b30f1798

    • SHA512

      cd6c4f6229a5d97a9b335cbbaf16e4ceab2efde6dd6e17ea0e8645d12739bd2a7ab8e6a77887dd92894af17305df6aafd051c0bfdd8fe7965225f0d538d9fbc5

    • SSDEEP

      768:+MFJ2BAxBMXR5OavIpl2d90CfOmPiEq586H+XVhMZEILH5DMnuqUch04U0VTLgSv:HJmm+g58TXsDpUuqbdLuGjhDeVclN

    Score
    10/10
    asyncratrat

    • AsyncRat

      AsyncRAT is designed to remotely monitor and control other computers written in C#.

      ratasyncrat

    • Asyncrat family

      asyncrat
    behavioral21

    • Target

      VenomRAT v6.0.3/Stub/Clientx64.exe

    • Size

      71KB

    • MD5

      33aa30124ec0b36f1a9319cd62a11e84

    • SHA1

      f8181335be708048b28cf1540054a5dd9d6acf8c

    • SHA256

      c6a8838b3619db76fc89af6bbd9188f868557348b3d06e2815eae2882dae8ec3

    • SHA512

      fceed2946791b47eb3e9f5b94fb11104abdc6bd8c2ae3c4c4694880af168608822a0b77ceecaeda125a04ffe2fcc081bf0e003c17ba3dc34a6ad261d45da7e65

    • SSDEEP

      768:aEFJ2BAxBMXR5OavIpl2d90CfOmfiEq586H+XVhMxEILH5DMnuqLch04U0VTLgSS:LJmm+A58TXsLpUuqudLuGjhMCVclN

    Score
    10/10
    asyncratrat

    • AsyncRat

      AsyncRAT is designed to remotely monitor and control other computers written in C#.

      ratasyncrat

    • Asyncrat family

      asyncrat
    behavioral22

    • Target

      VenomRAT v6.0.3/Stub/Clientx86.exe

    • Size

      71KB

    • MD5

      9e58447fdcf9d7625879dc2f8e51d41e

    • SHA1

      2b64506b4f318a4154f51dec8db498b0ca2f075b

    • SHA256

      fb646f0abb2d769531bdcbbb33c15b8d65a2f948a9b027005a007f1ae7fb6d23

    • SHA512

      bcf6ec720c1d8e7e3608453f05626db9569b32448c53520b52c143c1da6e5c015105d57dccaf6b47bfd37fa757a91cfa647c7e5832a7d52b8eb0bb6955615fbf

    • SSDEEP

      768:j2FJ2BAxBMXR5OavIpl2d90CfOm3iEq586H+XVhMxEILH5DMnuqkch04U0VTLgSy:gJmm+I58TXsLpUuqrdLuGjhsuVclN

    Score
    10/10
    asyncratdiscoveryrat

    • AsyncRat

      AsyncRAT is designed to remotely monitor and control other computers written in C#.

      ratasyncrat

    • Asyncrat family

      asyncrat
    behavioral23

    • Target

      VenomRAT v6.0.3/System.IO.Compression.dll

    • Size

      65KB

    • MD5

      24e74963a68d66fcfae334d91f5c5b33

    • SHA1

      c0cf3df19033cdc055c627867795d8e458a67ccc

    • SHA256

      10a7c576a8bc639b63b9a1c6b5f8d38f85e34b3f020106b27076d395ac3d82be

    • SHA512

      6d28dd711ab97924a2e807d7df61dece98df9f262b55093e5d58117740316dfba33d329a3e75662aeed5c396e8a67afe62a099f5e6887ed23cd0d082718fe7ac

    • SSDEEP

      1536:1TABDIGPGNWQT7872ea/LSbqfMY2ZztUZzQ:mxIGNQTQqesSu0YcAU

    Score
    1/10
    behavioral24

    • Target

      VenomRAT v6.0.3/System.ServiceModel.Internals.dll

    • Size

      804KB

    • MD5

      7f35e0251f45807e872ee0a354a8fe81

    • SHA1

      74cebb21cb95165774ea0ab082cb85cd3458ca8d

    • SHA256

      805d9e2c5cd2f2b17e68763ae4eb1db0103bd278e526de32f98e0cd336541e14

    • SHA512

      c5dfd9e43295b786eae9869ac1ede564d9d86255a58b3cf2f9af313c355fab8d5c3c4bd41291da65729ae510000446290588e9d67b2e65aa6da10777c6f5d38b

    • SSDEEP

      12288:Nk6q80n+FoAY2aScs0pbpcCqunbh9Xj9OtCXK0VWLmYss:snhATaScs0pmCq8YtCXp8mYs

    Score
    3/10
    discovery
    behavioral25

    • Target

      VenomRAT v6.0.3/VenomRAT v6.0.3.exe

    • Size

      14.3MB

    • MD5

      674fb9de862cbbb47a6ab5a7adb91d7e

    • SHA1

      5895e99a1cb66771735bb93d6fc85110d064ac88

    • SHA256

      dcb9b3bd02e4bca6dab8da73cfe8ff256cf70b2fef9aebd35f9c860b2e1df60e

    • SHA512

      444d9c6519c1564520a93ca49edf1a7bb742043f53bcf3cb6fe7ae5561253515f39aa197cb39d10a140ac2fdf3b4986034d9f6f2264000965bd2eba94ec99602

    • SSDEEP

      393216:vPv87RoDvSCG33lKqxsyEFfy1MpRt/RlY1V:vPv8727S/nweEFPRt5W1V

    Score
    10/10
    asyncratxwormexecutionpersistencerattrojan

    • AsyncRat

      AsyncRAT is designed to remotely monitor and control other computers written in C#.

      ratasyncrat

    • Asyncrat family

      asyncrat

    • Detect Xworm Payload

    • Xworm

      Xworm is a remote access trojan written in C#.

      trojanratxworm

    • Xworm family

      xworm

    • Command and Scripting Interpreter: PowerShell

      Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

      execution

    • Drops startup file

    • Executes dropped EXE

    • Adds Run key to start application

      persistence

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    behavioral26

    • Target

      VenomRAT v6.0.3/Vestris.ResourceLib.dll

    • Size

      76KB

    • MD5

      944ce5123c94c66a50376e7b37e3a6a6

    • SHA1

      a1936ac79c987a5ba47ca3d023f740401f73529b

    • SHA256

      7da3f0e77c4dddc82df7c16c8c781fade599b7c91e3d32eefbce215b8f06b12a

    • SHA512

      4c034ff51cc01567f3cb0796575528ca44623b864eb606266bcf955a9259ed26b20bec0086d79038158d3a5af2ada0a90f59d7c6aae9e545294fe77825dbe08b

    • SSDEEP

      1536:CSSYikTF0Z+sFGu11tIcyI1MtI9eDG3fL7:CJYD0Z9FGu11teI1r9ea3

    Score
    1/10
    behavioral27

    • Target

      VenomRAT v6.0.3/cGeoIp.dll

    • Size

      2.3MB

    • MD5

      6d6e172e7965d1250a4a6f8a0513aa9f

    • SHA1

      b0fd4f64e837f48682874251c93258ee2cbcad2b

    • SHA256

      d1ddd15e9c727a5ecf78d3918c17aee0512f5b181ad44952686beb89146e6bd0

    • SHA512

      35daa38ad009599145aa241102bcd1f69b4caa55ebc5bb11df0a06567056c0ec5fcd02a33576c54c670755a6384e0229fd2f96622f12304dec58f79e1e834155

    • SSDEEP

      24576:TRgJE8pkCLLe/K43EnnnclQwIqJY0OjklWXQMFBRpmkL/59ah0USm3uwl00odi9p:TRgfX/59a6USdi9Ues6bV6boLO6r

    Score
    1/10
    behavioral28

    • Target

      VenomRAT v6.0.3/dnlib.dll

    • Size

      1.1MB

    • MD5

      5cc2bb48b5e8c8ac0b99669401d15456

    • SHA1

      02e9ae08f3ec364834eb3ffc122f1c90e1b0e95e

    • SHA256

      648950f725fb0320e09c52dcaf81764916df96dc62e7429ba67daea0acb784ea

    • SHA512

      2867e94cee9f89f1cf85ad01083d75f4bc0bc0e551b2ffae05581828994f2b01a458ac7a7c94a45e8c40858ecce197f7ec23482ee13ef3f1bf82b33b89b3b420

    • SSDEEP

      24576:/bN7xZgKVl/N12pljD7DM2l8xs5A/zYv7flNcK:DyJXn3ML7G

    Score
    1/10
    behavioral29

    • Target

      VenomRAT v6.0.3/netstandard.dll

    • Size

      96KB

    • MD5

      0adf6f32f4d14f9b0be9aa94f7efb279

    • SHA1

      68e1af02cddd57b5581708984c2b4a35074982a3

    • SHA256

      8be4a2270f8b2bea40f33f79869fdcca34e07bb764e63b81ded49d90d2b720dd

    • SHA512

      f81ac2895048333ac50e550d2b03e90003865f18058ce4a1dfba9455a5bda2485a2d31b0fdc77f6cbdfb1bb2e32d9f8ab81b3201d96d56e060e4a440719502d6

    • SSDEEP

      1536:Q2Ec05j4eAH64rh5fSt5T9nFcI94WiVQTjpu:nlK4eA7mDmWqQXpu

    Score
    1/10
    behavioral30

    • Target

      VenomRAT v6.0.3/protobuf-net.Core.dll

    • Size

      274KB

    • MD5

      455b9dae976a4c36e8ff5f5410fb19d5

    • SHA1

      9ff8128e0ea3a38e96783c7d1c5972af3e31532c

    • SHA256

      c7ea80a04d604ad816a58dd21ab2fe765c1f3c36ddc82ee00e55705e316522ba

    • SHA512

      e468f1295f9316195d5241aa7262ad1a311e541a9da6f98e8a726805e9001fb1e21df42f6db5c18c7f755649d20cb0a16e78e0f50784fddd2ec0cd66f11017f7

    • SSDEEP

      6144:pi+J7CHEvQA8POLEimpJ6t4palxKQJrY+elOI:nZoAuqc6tt5rYlO

    Score
    1/10
    behavioral31

    • Target

      VenomRAT v6.0.3/protobuf-net.dll

    • Size

      263KB

    • MD5

      9fa500dd5384ba90daf82ae3b55a3418

    • SHA1

      e542ab2a9c8e09ae967011098805586689dc98f3

    • SHA256

      2c93e48721089d468fc844a46365d7b160bac49f93cda07a8a956f918aebf158

    • SHA512

      3c026b1934df3afffd09aa018b842eefb9446b402d6df0a807f65609ca3ff738f815dda4ec9d02089a0b910ceaac807c66d5fd698db17fbc42df624a4ea3826a

    • SSDEEP

      3072:suX8HlAtaCHC2J7j+ryZpII4NSe3OzyA8hw44/CMOzw0aJOjBWrVwg9D/FO3KZXP:5MqaCL+uZpr4NSEfhnOOzw0Vti9EKR

    Score
    1/10
    behavioral32

MITRE ATT&CK Enterprise v15

Tasks

static1

ratstormkittyasyncrat
Score
10/10

behavioral1

Score
1/10

behavioral2

Score
1/10

behavioral3

Score
1/10

behavioral4

Score
1/10

behavioral5

Score
1/10

behavioral6

Score
1/10

behavioral7

Score
1/10

behavioral8

Score
1/10

behavioral9

Score
1/10

behavioral10

Score
1/10

behavioral11

Score
1/10

behavioral12

execution
Score
3/10

behavioral13

execution
Score
3/10

behavioral14

execution
Score
3/10

behavioral15

Score
1/10

behavioral16

execution
Score
3/10

behavioral17

execution
Score
3/10

behavioral18

Score
1/10

behavioral19

Score
1/10

behavioral20

Score
1/10

behavioral21

asyncratrat
Score
10/10

behavioral22

asyncratrat
Score
10/10

behavioral23

asyncratdiscoveryrat
Score
10/10

behavioral24

Score
1/10

behavioral25

discovery
Score
3/10

behavioral26

asyncratxwormexecutionpersistencerattrojan
Score
10/10

behavioral27

Score
1/10

behavioral28

Score
1/10

behavioral29

Score
1/10

behavioral30

Score
1/10

behavioral31

Score
1/10

behavioral32

Score
1/10