General

  • Target

    shellcode_loader.exe

  • Size

    1.7MB

  • Sample

    250412-1rpdmsssfw

  • MD5

    d4fe738d7991a00669410578b9eb7ca9

  • SHA1

    d4d1f3eb846d735b0679144d355c3daf2e8467e1

  • SHA256

    d5d261f32c317717df4289fc4d6c5d2155b3c4d545fbd7e55cd24152f35042da

  • SHA512

    b97888483aafa8f640caabb500ae445cf891deedb6f60b2c52c8905eb2cdd6f715c33ac2444fba3460f7444453777724d25c581b071a9e702e85b28e22ddd838

  • SSDEEP

    49152:HKayovwasyyNGbfFd+vCRVNDzAv7G/VlCm4IU6i:aYmAvH+

Malware Config

Extracted

Family

asyncrat

Version

L838 RAT v1.0.0

Botnet

Default

Mutex

sfsafqagbiv

Attributes
  • delay

    1

  • install

    true

  • install_file

    Runtime Broker.exe

  • install_folder

    %AppData%

  • pastebin_config

    https://pastebin.com/raw/rVJQPNVe

aes.plain
1
9bFUN5r32sHNui7EX0b3oDW5uLxGVUiq

Targets

    • Target

      shellcode_loader.exe

    • Size

      1.7MB

    • MD5

      d4fe738d7991a00669410578b9eb7ca9

    • SHA1

      d4d1f3eb846d735b0679144d355c3daf2e8467e1

    • SHA256

      d5d261f32c317717df4289fc4d6c5d2155b3c4d545fbd7e55cd24152f35042da

    • SHA512

      b97888483aafa8f640caabb500ae445cf891deedb6f60b2c52c8905eb2cdd6f715c33ac2444fba3460f7444453777724d25c581b071a9e702e85b28e22ddd838

    • SSDEEP

      49152:HKayovwasyyNGbfFd+vCRVNDzAv7G/VlCm4IU6i:aYmAvH+

    • AsyncRat

      AsyncRAT is designed to remotely monitor and control other computers written in C#.

    • Asyncrat family

    • VenomRAT

      Detects VenomRAT.

    • Venomrat family

    • Async RAT payload

    • Legitimate hosting services abused for malware hosting/C2

MITRE ATT&CK Enterprise v16

Tasks

We care about your privacy.

This website stores cookies on your computer. These cookies are used to improve your website experience and provide more personalized services to you, both on this website and through other media. To find out more about the cookies we use, see our Privacy Policy.