asyncrat | ebc030bff7ec422a31186bf835b34a78923f47d780e6e7fc67b26b9a1bad611e

Analysis

max time kernel
104s
max time network
112s
platform
windows10-2004_x64
resource
win10v2004-20250410-en
resource tags

arch:x64arch:x86image:win10v2004-20250410-enlocale:en-usos:windows10-2004-x64system
submitted
12/04/2025, 22:05

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

shellcode_loader.exe
Size

1.8MB
MD5

7d850bc7e19509f4dfe8e7965177a7f8
SHA1

c224ed1020eb582724c5b2fd06d9e9cf28fecb11
SHA256

ebc030bff7ec422a31186bf835b34a78923f47d780e6e7fc67b26b9a1bad611e
SHA512

100e6520d758b1f7854f70b38b40139de56ef16bfaab6241ba999e50332cce9d37a2a6aed1081fcbc53bb71fa62e97d17a776fc144cdbf025e85ce486533478c
SSDEEP

49152:9wl2T3SBOs3++1zZTFIfST7GIcaQ69H18+++L4IU6i4o:x0FUgH42H+4o

Score

10^/10

asyncrat venomrat default rat

Malware Config

Extracted

Family

asyncrat

Version

L838 RAT v1.0.0

Botnet

Default

Mutex

sfsafqagbiv

Attributes

delay
1
install
true
install_file
Runtime Broker.exe
install_folder
%AppData%
pastebin_config
https://pastebin.com/raw/rVJQPNVe

aes.plain

Signatures

AsyncRat
AsyncRAT is designed to remotely monitor and control other computers written in C#.
rat asyncrat
Asyncrat family
asyncrat

VenomRAT 1 IoCs

Detects VenomRAT.

rat

resource	yara_rule
behavioral1/memory/184-1-0x0000022BC12D0000-0x0000022BC12E3000-memory.dmp	VenomRAT

Venomrat family
venomrat

Async RAT payload 1 IoCs

rat

resource	yara_rule
behavioral1/memory/184-1-0x0000022BC12D0000-0x0000022BC12E3000-memory.dmp	family_asyncrat

Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service

T1102

flow	ioc
1	pastebin.com
2	pastebin.com

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 184 wrote to memory of 1192	184	shellcode_loader.exe	85
PID 184 wrote to memory of 1192	184	shellcode_loader.exe	85

C:\Users\Admin\AppData\Local\Temp\shellcode_loader.exe
"C:\Users\Admin\AppData\Local\Temp\shellcode_loader.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:184
- C:\Windows\system32\cmd.exe
  "cmd" /c cls
  2⤵
  PID:1192

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/184-1-0x0000022BC12D0000-0x0000022BC12E3000-memory.dmp

Filesize
76KB

Download