asyncrat | 665021891c2107bf07aac21f15256b0f35fe48ba6a8c1366cb21eb0a6a6305c3

Analysis

max time kernel
147s
max time network
119s
platform
windows7_x64
resource
win7-20241010-en
resource tags

arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system
submitted
30/03/2025, 14:42 UTC

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Client.exe
Size

63KB
MD5

b432802359352b284549db6b7c03396c
SHA1

175840b42bfbb8054b97a389e88dae80c75448ff
SHA256

665021891c2107bf07aac21f15256b0f35fe48ba6a8c1366cb21eb0a6a6305c3
SHA512

9f2737fd171b495bf7ec3507dbb4e021867adb9716b12b79ba9d8ac4de625b16a30ef2f7b209f889d06230ee43b387d98041f015b4cf71dfef48b4245ee83547
SSDEEP

1536:QhB5LrUwk4XO01V5eeiIVrGbbXwZxGODpqKmY7:QhB5LrUwk4XVVseXGbbXwgz

Score

10^/10

asyncrat venom clients rat

Malware Config

Extracted

Family

asyncrat

Version

5.0.5

Botnet

Venom Clients

127.0.0.1:4449

Mutex

Venom_RAT_HVNC_Mutex_Venom RAT_HVNC

Attributes

delay
1
install
false
install_folder
%AppData%

aes.plain

1
2olT1JkDeWCcd97edvNsnuekk7VZgMHY

Signatures

AsyncRat
AsyncRAT is designed to remotely monitor and control other computers written in C#.
rat asyncrat
Asyncrat family
asyncrat

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	1280	Client.exe

C:\Users\Admin\AppData\Local\Temp\Client.exe
"C:\Users\Admin\AppData\Local\Temp\Client.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:1280

Network

No results found

127.0.0.1:4449

Client.exe
127.0.0.1:4449

Client.exe
127.0.0.1:4449

Client.exe
127.0.0.1:4449

Client.exe
127.0.0.1:4449

Client.exe
127.0.0.1:4449

Client.exe
127.0.0.1:4449

Client.exe
127.0.0.1:4449

Client.exe
127.0.0.1:4449

Client.exe
127.0.0.1:4449

Client.exe
127.0.0.1:4449

Client.exe
127.0.0.1:4449

Client.exe
127.0.0.1:4449

Client.exe
127.0.0.1:4449

Client.exe
127.0.0.1:4449

Client.exe
127.0.0.1:4449

Client.exe
127.0.0.1:4449

Client.exe
127.0.0.1:4449

Client.exe
127.0.0.1:4449

Client.exe
127.0.0.1:4449

Client.exe
127.0.0.1:4449

Client.exe
127.0.0.1:4449

Client.exe
127.0.0.1:4449

Client.exe
127.0.0.1:4449

Client.exe
127.0.0.1:4449

Client.exe

No results found

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1280-3-0x000007FEF5AB0000-0x000007FEF649C000-memory.dmp

Filesize
9.9MB

Download
memory/1280-2-0x000007FEF5AB0000-0x000007FEF649C000-memory.dmp

Filesize
9.9MB

Download
memory/1280-1-0x0000000001270000-0x0000000001286000-memory.dmp

Filesize
88KB

Download
memory/1280-0-0x000007FEF5AB3000-0x000007FEF5AB4000-memory.dmp

Filesize
4KB

Download
memory/1280-4-0x000007FEF5AB3000-0x000007FEF5AB4000-memory.dmp

Filesize
4KB

Download
memory/1280-5-0x000007FEF5AB0000-0x000007FEF649C000-memory.dmp

Filesize
9.9MB

Download