Overview

overview

10

Static

static

10

Grabberhydra.exe

windows10-ltsc_2021-x64

10

Hydra.exe

windows10-ltsc_2021-x64

10

Resubmissions

31/03/2025, 18:00

250331-wlak3svtby 10

31/03/2025, 17:58

250331-wkcztavtbt 10

28/03/2025, 19:30

250328-x72gcsskw6 10

Analysis

  • max time kernel
    101s
  • max time network
    146s
  • platform
    windows10-ltsc_2021_x64
  • resource
    win10ltsc2021-20250314-en
  • resource tags

    arch:x64arch:x86image:win10ltsc2021-20250314-enlocale:en-usos:windows10-ltsc_2021-x64system
  • submitted
    31/03/2025, 18:00

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    Hydra.exe

  • Size

    74KB

  • MD5

    78ab7dfadb3813980dc8ad8620c7d95f

  • SHA1

    9e0e1fc73ec77341164b536010f0fc5a523ff668

  • SHA256

    7e2bb9f90d504bb61da3b8949d6c8eb78cfd65f800e6281f61d0bf8f46e11746

  • SHA512

    06d4f2a194511d50e2691c045af7bc1795ddf9d07e628495e8c21876e291dae6b16254175adfe9b679e348039241de126ad78cfeec42b171403571afb0304f1b

  • SSDEEP

    1536:CUme0cxFVTuCGbPMVymD7a3ISH1b0/WNlNQrQzciLVclN:CUm3cxFVaBbPMVS7H1b0uNlqrQzBY

Score
10/10
asyncratdefaultrat

Malware Config

Extracted

Family

asyncrat

Version

Venom RAT + HVNC + Stealer + Grabber v6.0.3

Botnet

Default

C2

20.199.83.63:8080

Mutex

ceqyzqxvsux

Attributes
  • delay

    1

  • install

    true

  • install_file

    das.exe

  • install_folder

    %AppData%

aes.plain

Signatures

  • AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat
  • Asyncrat family
    asyncrat
  • Suspicious use of AdjustPrivilegeToken 43 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\Hydra.exe
    "C:\Users\Admin\AppData\Local\Temp\Hydra.exe"
    1⤵
    • Suspicious use of AdjustPrivilegeToken
    PID:1968

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/1968-0-0x00007FFA25613000-0x00007FFA25615000-memory.dmp

    Filesize

    8KB

    Download

  • memory/1968-1-0x00000000000E0000-0x00000000000F8000-memory.dmp

    Filesize

    96KB

    Download

  • memory/1968-3-0x00007FFA25610000-0x00007FFA260D2000-memory.dmp

    Filesize

    10.8MB

    Download

  • memory/1968-4-0x00007FFA25610000-0x00007FFA260D2000-memory.dmp

    Filesize

    10.8MB

    Download