Analysis
-
max time kernel
2s -
platform
windows11-21h2_x64 -
resource
win11-20250410-en -
resource tags
-
submitted
21/04/2025, 19:50
General
-
Target
250421-yjtbhsttbs.exe
-
Size
63KB
-
MD5
e0e1341087c4322f6c13c4186510c4b7
-
SHA1
cee1280d0a2da82b5179307428a0cd2481a66abe
-
SHA256
4c48dabdcdd34b157eacde37eedb2d8be7a9817805daa057cfc7c103a789e4af
-
SHA512
216f0ad65407bd2038b19c8de8cbd09774a4cf4b0157c9ce8aa477065c4c5e7a8237a11875eadd2f5781f66b15b9cce373db7161e10cbc61fa418775c5073190
-
SSDEEP
1536:KZuttUdjLAQJlZGLAncCGbbvwoAlGJ2pqKmY7:KZuttUdjvJlZGUrGbbvj1z
Score
10/10
Malware Config
Extracted
Family
asyncrat
Version
5.0.5
Botnet
Clients
C2
ahmedyassin.ddns.net:4449
Mutex
Venom_RAT_HVNC_Mutex_Venom RAT_HVNC
Attributes
-
delay
1
-
install
true
-
install_file
jesus.exe
-
install_folder
%AppData%
aes.plain
Signatures
-
AsyncRat
AsyncRAT is designed to remotely monitor and control other computers written in C#.
-
Asyncrat family
-
Suspicious use of AdjustPrivilegeToken 21 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\250421-yjtbhsttbs.exe"C:\Users\Admin\AppData\Local\Temp\250421-yjtbhsttbs.exe"1⤵
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
8KB
-
Filesize
88KB
-
Filesize
10.8MB
-
Filesize
10.8MB