Overview

overview

10

Static

static

1

b037843ef2...37.exe

windows7-x64

10

b037843ef2...37.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    b037843ef212f9907c4c2f22167379db44aa02d7c647c53278b4d8d784343537.zip

  • Size

    127KB

  • Sample

    250208-skmx8stjfn

  • MD5

    e28c9b5ba60cb38c6243944cbf4095ff

  • SHA1

    cd1ff829ecb9bbf5ac76c91478b80ab7232536a9

  • SHA256

    81f8466583c0a4edff411a3c7a4b2a82a3ef97ebe1f03c3df99500e70c95a399

  • SHA512

    0cd54b2fa980dd2011313b0b4647a05ef52e42a523d5b8bd550f76d525f599139e211c0ba3aefd0375e6f93c47aa2f3f22d27812b9491374d37bdfe0e027a2b9

  • SSDEEP

    3072:Fib9AFY/HqthrZnws3104VMaHh8s6lfrNhUZ7kJ8D5rybQK4w:FibOFYCasF04VvFK/UZ7kJ25ryt4w

Score
10/10
asyncratvenomratdefaultdiscoveryrat

Malware Config

Extracted

Family

asyncrat

Version

Venom RAT + HVNC + Stealer + Grabber v6.0.3

Botnet

Default

C2

89.23.100.93:4449

Mutex

oonrejgwedvxwse

Attributes
  • delay

    1

  • install

    true

  • install_file

    calc.exe

  • install_folder

    %AppData%

aes.plain

Targets

    • Target

      b037843ef212f9907c4c2f22167379db44aa02d7c647c53278b4d8d784343537.exe

    • Size

      243KB

    • MD5

      d88a06a393582a79ab6da48982ec87ae

    • SHA1

      e5cc4271431fa138f4594847c20a5be3f6c919e4

    • SHA256

      b037843ef212f9907c4c2f22167379db44aa02d7c647c53278b4d8d784343537

    • SHA512

      41c75993633bf8d1f2dd9ab956ed40510a1d7678214a5311aed096c0e4678d6df57542908c4329f2424e9cb488f15cd554b06b151e909f7c70e4ce9d9a9191ac

    • SSDEEP

      3072:KHkVhd52JYWsfVrhbjAY1GSEuywqamd/4bWSHqYubGtHshmRgSPG9oMNLxb:KHkVhd52JdYhbt1GCE2bUwZe+PElNh

    Score
    10/10
    asyncratvenomratdefaultdiscoveryrat

    • AsyncRat

      AsyncRAT is designed to remotely monitor and control other computers written in C#.

      ratasyncrat

    • Asyncrat family

      asyncrat

    • VenomRAT

      Detects VenomRAT.

      rat

    • Venomrat family

      venomrat

    • Downloads MZ/PE file

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Loads dropped DLL

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks