General
-
Target
PantiBootStrapper.exe
-
Size
74KB
-
Sample
250123-vfh5lawmfs
-
MD5
843f9a8b2e3284b06d2d343cbcf5a884
-
SHA1
da31933428722d65568ead0f7b20b72ba423680e
-
SHA256
3e8a98ded7fab1daa8a07a2a035f28a2e4f3404f79d59285ac6f11180d1211d4
-
SHA512
4b2751733006050154d7ff9bb77d70cbf39705041ca5a3c53b752b06f7a9ef197575a93ef3d4ba21fd853c598add7591c7f8b8176d43eb444900668f56f6b694
-
SSDEEP
1536:JUKkcx9pXCTyPMVvWC+I4H1bF/5RAMQzc6LVclN:JUDcx958yPMVvWCwH1bFfQrBY
Behavioral task
behavioral1
Sample
PantiBootStrapper.exe
Resource
win7-20241010-en
Malware Config
Extracted
asyncrat
Venom RAT + HVNC + Stealer + Grabber v6.0.3
Default
195.88.218.126:2404
mojnuowhevbf
-
delay
1
-
install
true
-
install_file
svchost.exe
-
install_folder
%AppData%
Targets
-
-
Target
PantiBootStrapper.exe
-
Size
74KB
-
MD5
843f9a8b2e3284b06d2d343cbcf5a884
-
SHA1
da31933428722d65568ead0f7b20b72ba423680e
-
SHA256
3e8a98ded7fab1daa8a07a2a035f28a2e4f3404f79d59285ac6f11180d1211d4
-
SHA512
4b2751733006050154d7ff9bb77d70cbf39705041ca5a3c53b752b06f7a9ef197575a93ef3d4ba21fd853c598add7591c7f8b8176d43eb444900668f56f6b694
-
SSDEEP
1536:JUKkcx9pXCTyPMVvWC+I4H1bF/5RAMQzc6LVclN:JUDcx958yPMVvWCwH1bFfQrBY
-
Asyncrat family
-
Venomrat family
-
Async RAT payload
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE
-