Analysis
-
max time kernel
297s -
max time network
298s -
platform
windows11-21h2_x64 -
resource
win11-20241007-en -
resource tags
arch:x64arch:x86image:win11-20241007-enlocale:en-usos:windows11-21h2-x64system -
submitted
11-01-2025 10:24
General
-
Target
Client.exe
-
Size
74KB
-
MD5
33591b7426ecab86d4589e9dec20e5bc
-
SHA1
95f8b3b660d1e403d724bc08f4b9a78238b1b850
-
SHA256
ff443eda8ffc470acbbc9364f6eab5fd0de19f7e12aedc3f84d59aa98cc61e51
-
SHA512
63960d876c5bb070f708ed11b869041646d32b642b79f5b28e75a5c81ad2883f1adb5092106632d43e829e8357acdb619e325326201982ec8ccd6b865cff82b4
-
SSDEEP
1536:1ULkcxVKpC6yPMVKe9VdQuDI6H1bf/sVvQzcGLVclN:1UocxVENyPMVKe9VdQsH1bfUvQfBY
Malware Config
Extracted
Family
asyncrat
Version
Venom RAT + HVNC + Stealer + Grabber v6.0.3
Botnet
Default
Mutex
gedfggggnerrtrttf
Attributes
-
delay
1
-
install
false
-
install_folder
%AppData%
-
pastebin_config
https://pastebin.com/raw/4sQ9rmGV
aes.plain
Signatures
-
Asyncrat family
-
Legitimate hosting services abused for malware hosting/C2 1 TTPs 64 IoCs
flow ioc 53 pastebin.com 72 pastebin.com 84 pastebin.com 17 pastebin.com 28 pastebin.com 23 pastebin.com 24 pastebin.com 32 pastebin.com 59 pastebin.com 89 pastebin.com 93 pastebin.com 7 pastebin.com 10 pastebin.com 74 pastebin.com 78 pastebin.com 91 pastebin.com 18 pastebin.com 56 pastebin.com 48 pastebin.com 55 pastebin.com 20 pastebin.com 34 pastebin.com 61 pastebin.com 73 pastebin.com 77 pastebin.com 8 pastebin.com 27 pastebin.com 87 pastebin.com 38 pastebin.com 63 pastebin.com 16 pastebin.com 41 pastebin.com 60 pastebin.com 2 pastebin.com 12 pastebin.com 46 pastebin.com 52 pastebin.com 57 pastebin.com 94 pastebin.com 9 pastebin.com 30 pastebin.com 19 pastebin.com 21 pastebin.com 22 pastebin.com 36 pastebin.com 54 pastebin.com 65 pastebin.com 5 pastebin.com 6 pastebin.com 79 pastebin.com 80 pastebin.com 88 pastebin.com 66 pastebin.com 70 pastebin.com 39 pastebin.com 49 pastebin.com 67 pastebin.com 82 pastebin.com 11 pastebin.com 29 pastebin.com 26 pastebin.com 50 pastebin.com 51 pastebin.com 62 pastebin.com -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 1156 Client.exe 1156 Client.exe 1156 Client.exe 1156 Client.exe 1156 Client.exe 1156 Client.exe 1156 Client.exe 1156 Client.exe 1156 Client.exe 1156 Client.exe 1156 Client.exe 1156 Client.exe 1156 Client.exe 1156 Client.exe 1156 Client.exe 1156 Client.exe 1156 Client.exe 1156 Client.exe 1156 Client.exe 1156 Client.exe 1156 Client.exe 1156 Client.exe 1156 Client.exe 1156 Client.exe 1156 Client.exe 1156 Client.exe 1156 Client.exe 1156 Client.exe 1156 Client.exe 1156 Client.exe 1156 Client.exe 1156 Client.exe 1156 Client.exe 1156 Client.exe 1156 Client.exe 1156 Client.exe 1156 Client.exe 1156 Client.exe 1156 Client.exe 1156 Client.exe 1156 Client.exe 1156 Client.exe 1156 Client.exe 1156 Client.exe 1156 Client.exe 1156 Client.exe 1156 Client.exe 1156 Client.exe 1156 Client.exe 1156 Client.exe 1156 Client.exe 1156 Client.exe 1156 Client.exe 1156 Client.exe 1156 Client.exe 1156 Client.exe 1156 Client.exe 1156 Client.exe 1156 Client.exe 1156 Client.exe 1156 Client.exe 1156 Client.exe 1156 Client.exe 1156 Client.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 1156 Client.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 1156 Client.exe