Analysis
-
max time kernel
147s -
max time network
126s -
platform
windows7_x64 -
resource
win7-20241010-en -
resource tags
-
submitted
26/03/2025, 20:05
General
-
Target
00db3fc8bcecd84dfcc71e93de99ae9ffaf0fb73a7ef37fa5a5bd32e24c272f9.exe
-
Size
146KB
-
MD5
aa8cfcab0a8cf1ce87197b9fe06699ea
-
SHA1
203186b8f12c6f372674863ac4bdaa89758e4da3
-
SHA256
00db3fc8bcecd84dfcc71e93de99ae9ffaf0fb73a7ef37fa5a5bd32e24c272f9
-
SHA512
b94905e40662dd66691d20df7cc6e6c61fe127a9d0a6ac80950ebf1677505fe484c41f4f5b079dcc50e966ee8893736f1acc4724c1fb232177432e456f4e5a78
-
SSDEEP
3072:UUmcxV4x7PMVee9VdQsH1bfWjj2QF9BeF+YzB1hXeiYY0I26Qq4KY:Ulx7PMVeaesVbtmBeYA/mIBpD
Score
10/10
Malware Config
Extracted
Family
asyncrat
Version
Venom RAT + HVNC + Stealer + Grabber v6.0.3
Botnet
Default
C2
127.0.0.1:4449
Mutex
btvnlmvpvp
Attributes
-
delay
3
-
install
false
-
install_folder
%AppData%
aes.plain
Signatures
-
AsyncRat
AsyncRAT is designed to remotely monitor and control other computers written in C#.
-
Asyncrat family
-
VenomRAT 1 IoCs
Detects VenomRAT.
-
Venomrat family
-
Suspicious behavior: EnumeratesProcesses 37 IoCs
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
-
Suspicious use of SetWindowsHookEx 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\00db3fc8bcecd84dfcc71e93de99ae9ffaf0fb73a7ef37fa5a5bd32e24c272f9.exe"C:\Users\Admin\AppData\Local\Temp\00db3fc8bcecd84dfcc71e93de99ae9ffaf0fb73a7ef37fa5a5bd32e24c272f9.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
4KB
-
Filesize
168KB
-
Filesize
9.9MB
-
Filesize
9.9MB
-
Filesize
4KB
-
Filesize
9.9MB
-
Filesize
9.9MB