Resubmissions
13-01-2025 01:08
250113-bhl5gs1kfl 1012-01-2025 12:45
250112-pzgszsspby 1010-01-2025 15:08
250110-shv6tszqaq 10Analysis
-
max time kernel
887s -
max time network
895s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
-
submitted
13-01-2025 01:08
General
-
Target
Client.exe
-
Size
74KB
-
MD5
5b1f7f243956595af2cef317a273275e
-
SHA1
f6bcfbc268be9c272559f7345d1684b27d983fe1
-
SHA256
c29bc00a3915c04961b3a25c499c3c9f43c33c6b484c00df4a5c8b3695344bea
-
SHA512
1979d0564afeeaec460c86179707ff29da602ab1c66958453c52816f99e863665cdb0f08bb5b540615c8f54b752dc8ba8bb655a15b52eb5a0c5d4d9d33dccfbf
-
SSDEEP
1536:EUzkcx4VHsC0SPMV7e9VdQuDI6H1bf/0dmIQzc2LVclN:EUwcx4GfSPMV7e9VdQsH1bfEmIQPBY
Score
10/10
Malware Config
Extracted
Family
asyncrat
Version
Venom RAT + HVNC + Stealer + Grabber v6.0.3
Botnet
Default
C2
127.0.0.1:4449
127.0.0.1:8000
127.0.0.1:64240
193.161.193.99:4449
193.161.193.99:8000
193.161.193.99:64240
Mutex
oklwlbhdlrw
Attributes
-
delay
1
-
install
false
-
install_folder
%AppData%
aes.plain
Signatures
-
AsyncRat
AsyncRAT is designed to remotely monitor and control other computers written in C#.
-
Asyncrat family
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
-
Suspicious use of SetWindowsHookEx 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\Client.exeC:\Users\Admin\AppData\Local\Temp\Client.exe cmd /c %SIGILL% "SIGTERM|DELETE|SIGKILL"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
8KB
-
Filesize
96KB
-
Filesize
10.8MB
-
Filesize
8KB
-
Filesize
10.8MB