Overview

overview

10

Static

static

10

1234rwe.exe

windows7-x64

10

1234rwe.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    1234rwe.exe

  • Size

    74KB

  • Sample

    250101-nafzqawjcj

  • MD5

    f2d0418d8366c6555496da77cccddcee

  • SHA1

    812e7f5741fd7e6ba812eab3b8462b10d0adffbd

  • SHA256

    db08a16f34428dc8c27fa3ad293cac69a200050d94c93ced18b2436cba822b4f

  • SHA512

    e9278138b62923fd5fec1fe805751d1a786931adf45dce53457f4bf0e8af5e19b05321b67904912243c3642da04662e5c9ed89966a5120dd70f7fdabe14bda5c

  • SSDEEP

    1536:ZUxQcxh31CfGPMVKGggyVIrH1bo/JfO/V9QzcQxLVclN:ZUecxhlEGPMVRggygH1bot2V9QlxBY

Score
10/10
asyncratdefaultrat

Malware Config

Extracted

Family

asyncrat

Version

Venom RAT + HVNC + Stealer + Grabber v6.0.3

Botnet

Default

Mutex

ytgjjhywchk

Attributes
  • delay

    1

  • install

    true

  • install_file

    RealtekHighDefinitionAudio.exe

  • install_folder

    %AppData%

  • pastebin_config

    https://pastebin.com/raw/ZrvsMACD

aes.plain

Targets

    • Target

      1234rwe.exe

    • Size

      74KB

    • MD5

      f2d0418d8366c6555496da77cccddcee

    • SHA1

      812e7f5741fd7e6ba812eab3b8462b10d0adffbd

    • SHA256

      db08a16f34428dc8c27fa3ad293cac69a200050d94c93ced18b2436cba822b4f

    • SHA512

      e9278138b62923fd5fec1fe805751d1a786931adf45dce53457f4bf0e8af5e19b05321b67904912243c3642da04662e5c9ed89966a5120dd70f7fdabe14bda5c

    • SSDEEP

      1536:ZUxQcxh31CfGPMVKGggyVIrH1bo/JfO/V9QzcQxLVclN:ZUecxhlEGPMVRggygH1bot2V9QlxBY

    Score
    10/10
    asyncratdefaultrat

    • AsyncRat

      AsyncRAT is designed to remotely monitor and control other computers written in C#.

      ratasyncrat

    • Asyncrat family

      asyncrat

    • Async RAT payload

      rat

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Legitimate hosting services abused for malware hosting/C2

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks