Analysis
-
max time kernel
233s -
max time network
241s -
platform
windows11-21h2_x64 -
resource
win11-20241007-en -
resource tags
-
submitted
13-01-2025 18:33
General
-
Target
venomrat client.exe
-
Size
74KB
-
MD5
0ea07967c25b9067d64bf560f9a8657c
-
SHA1
18d9ea010a7b223c3a718ec2959d9d12b2efd9a5
-
SHA256
ebb50df0535f5b84b0e0eed0ba8c792ff90999310cf1fd0e486d80c499d8c1f7
-
SHA512
665552fd3aa71bebd6d14fbe4e68ffd398bd948ec0438017189ccebca3541e098f38807883a1392a609014fab0279a2d98f3c03f5eaddb64323e575804aa1816
-
SSDEEP
1536:kU8PcxVteCW7PMV7GPWOyqG3IHH1b1/+g7QzcmLVclN:kUucxV4x7PMV6uOyqGaH1b1mGQ/BY
Score
10/10
Malware Config
Extracted
Family
asyncrat
Version
Venom Pwn3rzs' Edtition v6.0.1
Botnet
Default
C2
127.0.0.1:4449
127.0.0.1:12371
52.28.112.211:4449
52.28.112.211:12371
Mutex
pqtqeocqbgg
Attributes
-
delay
1
-
install
false
-
install_folder
%AppData%
aes.plain
Signatures
-
AsyncRat
AsyncRAT is designed to remotely monitor and control other computers written in C#.
-
Asyncrat family
-
Suspicious behavior: EnumeratesProcesses 43 IoCs
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
-
Suspicious use of SetWindowsHookEx 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\venomrat client.exe"C:\Users\Admin\AppData\Local\Temp\venomrat client.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
8KB
-
Filesize
96KB
-
Filesize
10.8MB
-
Filesize
10.8MB
-
Filesize
8KB
-
Filesize
10.8MB