General

  • Target

    PO-VS037069410113706941011_19_02_25.exe

  • Size

    938KB

  • Sample

    250219-hcydwszkft

  • MD5

    d334528a305db04cd6c086958e317850

  • SHA1

    7edd4e5013e541f81a84a3eb95f63c679c65197b

  • SHA256

    c5634454eded38fdff4aa2966f68c4a969f705cd9ad266d48e169a12a66f8a77

  • SHA512

    d6a9dcbe3f663d851e184e727676fb25ecc4e89c93225a7de282adf28464eb5df6764b720c01ec68177083849e56fde8a610e6fc4fd33396629de14f4204e83f

  • SSDEEP

    6144:TM+EbbrRkif+eH2fES69xx8FZjATa3rcfwXJ8+3NWVQL0S+aNV1M9c0cPiQMWw2D:o+EbbrRBm+89mw1J/aQC2PqGvyrQ

Malware Config

Extracted

Family

asyncrat

Version

Venom RAT + HVNC + Stealer + Grabber v6.0.3

Botnet

FEB 19 LOGS

Mutex

dbwxbwyzgarszgoi

Attributes
  • delay

    1

  • install

    false

  • install_folder

    %AppData%

  • pastebin_config

    https://pastebin.com/raw/93hjERwM

aes.plain

Targets

    • Target

      PO-VS037069410113706941011_19_02_25.exe

    • Size

      938KB

    • MD5

      d334528a305db04cd6c086958e317850

    • SHA1

      7edd4e5013e541f81a84a3eb95f63c679c65197b

    • SHA256

      c5634454eded38fdff4aa2966f68c4a969f705cd9ad266d48e169a12a66f8a77

    • SHA512

      d6a9dcbe3f663d851e184e727676fb25ecc4e89c93225a7de282adf28464eb5df6764b720c01ec68177083849e56fde8a610e6fc4fd33396629de14f4204e83f

    • SSDEEP

      6144:TM+EbbrRkif+eH2fES69xx8FZjATa3rcfwXJ8+3NWVQL0S+aNV1M9c0cPiQMWw2D:o+EbbrRBm+89mw1J/aQC2PqGvyrQ

    • AsyncRat

      AsyncRAT is designed to remotely monitor and control other computers written in C#.

    • Asyncrat family

    • Modifies WinLogon for persistence

    • VenomRAT

      Detects VenomRAT.

    • Venomrat family

    • Executes dropped EXE

    • Loads dropped DLL

MITRE ATT&CK Enterprise v15

Tasks