General

  • Target

    c502384c7e37f78fdea4508cb3e33bb19e464e6a1c0a3ad3c6bbab07ad689682

  • Size

    3.1MB

  • Sample

    250330-x7479axpv6

  • MD5

    318dd600d5df858f9b12e161c1cdf794

  • SHA1

    d4eba922ccb8c301708f1b67f8e17fb5ae09aae5

  • SHA256

    c502384c7e37f78fdea4508cb3e33bb19e464e6a1c0a3ad3c6bbab07ad689682

  • SHA512

    7ec7944dc920d464a1d7370b60b7a65cfdb2c46be731e00e6631b8cb9e2307a7bb14282b0148bc2cbe241b2357f4f1466b68dfb9595446fa80446e27f65ba8bb

  • SSDEEP

    98304:DB3EVGIP9YVclwvxe3MLRWcq2cFhimdztR+Vm/2Z:DpGP9MycxijciFhrzd/2

Malware Config

Extracted

Family

asyncrat

Version

5.0.5

Botnet

Venom Clients

C2

178.117.80.225:3998

Mutex

Venom_RAT_HVNC_Mutex_Venom RAT_HVNC

Attributes
  • delay

    1

  • install

    false

  • install_folder

    %AppData%

aes.plain

Targets

    • Target

      c502384c7e37f78fdea4508cb3e33bb19e464e6a1c0a3ad3c6bbab07ad689682

    • Size

      3.1MB

    • MD5

      318dd600d5df858f9b12e161c1cdf794

    • SHA1

      d4eba922ccb8c301708f1b67f8e17fb5ae09aae5

    • SHA256

      c502384c7e37f78fdea4508cb3e33bb19e464e6a1c0a3ad3c6bbab07ad689682

    • SHA512

      7ec7944dc920d464a1d7370b60b7a65cfdb2c46be731e00e6631b8cb9e2307a7bb14282b0148bc2cbe241b2357f4f1466b68dfb9595446fa80446e27f65ba8bb

    • SSDEEP

      98304:DB3EVGIP9YVclwvxe3MLRWcq2cFhimdztR+Vm/2Z:DpGP9MycxijciFhrzd/2

    • AsyncRat

      AsyncRAT is designed to remotely monitor and control other computers written in C#.

    • Asyncrat family

    • Async RAT payload

    • Executes dropped EXE

    • Loads dropped DLL

    • Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v15

Tasks