asyncrat | 79c052f0804b910f9992c2b12001d10b7d4054d6e431638cde00cc39042a8cff

General

Target
79c052f0804b910f9992c2b12001d10b7d4054d6e431638cde00cc39042a8cff.zip
Size 4.9MB
Sample260503-b4ebrsd18l
SHA256 79c052f0804b910f9992c2b12001d10b7d4054d6e431638cde00cc39042a8cff
MD5 3b348ef59dcbbdf560cecbd2bbfff9ec
SHA1 b5c75f5d7127ceb71d34039f17d670e3b8ea617f
SHA512 a6c31193d837469c486cee7231f217db06656a680a3fce4fd3bca0a6146cd1c0004c232d6bfd284724b080165ba0d174d94eb5f8d69d6cb471dd78b815413b60
SSDEEP 98304:HmKvRbhmZL7N7gAN0RYM8BgX435JoifK9VS1Fy7TdXxKLiLK:Hm8chN7gqp7pNivS1Fy7TdXDLK
TLSH
T18536227AFB343181F51CAEB0BB05599853EFBEE6969CCF5026407E1A4CFA160578C836
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  dopuslib.dll
- Size 427.9MB
- SHA256 153888d497bbc1dc488dcbe6b2ef1bbcf4ccedff48ce9ca8f11fb37a71b2adb5
- MD5 5eaed0e4789765557e93127cf289099d
- SHA1 6f537ae0ce704cd7053d0cd5d64d1c00663199ce
- SHA512 2b31a516d8a3800e310c96ac08c03646e8f5bee26f1b90d4d96f124668647622de9e3ff41783d5c867a6c8c9f79d6d8f139aa6e48b817a249a38e3db9b35e17e
- SSDEEP 786432:67usJWXFBEGZk7lgWBn9lTy18RW23mdJ20J:6KLBEGZ6Oi9FyDOm72+
- TLSH
  T140298D877FCCABFEC507DBFE5715F63141D2993389BA90C46D96074A89B9A110F38A80
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

discovery asyncrat stormkitty venomrat persistence rat rootkit stealer
- Async RAT payload
  rat
- Family: AsyncRat
  AsyncRAT is designed to remotely monitor and control other computers written in C#.
  rat asyncrat
- Family: StormKitty
  StormKitty is an open source info stealer written in C#.
  stealer stormkitty
- Family: VenomRAT
  VenomRAT is a modified version of QuasarRAT with some added features, such as rootkit and stealer capabilites.
  rat rootkit stealer venomrat
- StormKitty payload
- VenomRAT
  Detects VenomRAT.
  rat
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
  persistence
behavioral1 behavioral2
- Target
  請求書.exe
- Size 475KB
- SHA256 e861ea62c87d4db82ffe5e7758ccd8247afba603069ecba68a2dfe67cae37b4c
- MD5 701ee6f27a469260b5001e7d466c7434
- SHA1 3038ea4e5899ca324a13198219c6cf57774dd162
- SHA512 5d329f3f7b7ca2d646a454d30ee3d3b0085894c96051c0a756b2c2642db80185d1804241b8cc5840520aa32873acf5c923330f8f2783e778912d759d5f0f5cf4
- SSDEEP 6144:nRsJwX40jlIxjFoPsWAkoS8LU35alSN4rqkj0C0jCecM1gZL1m:nRfX40jlIjoPWLBlSoz0C7eHCZL1m
- TLSH
  T1C5A42A2276AA1294D039487D58515528966F7C11CF706F9F02B2F6BE8F322CC1F16AFB
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

discovery asyncrat stormkitty venomrat persistence rat rootkit stealer
- Async RAT payload
  rat
- Family: AsyncRat
  AsyncRAT is designed to remotely monitor and control other computers written in C#.
  rat asyncrat
- Family: StormKitty
  StormKitty is an open source info stealer written in C#.
  stealer stormkitty
- Family: VenomRAT
  VenomRAT is a modified version of QuasarRAT with some added features, such as rootkit and stealer capabilites.
  rat rootkit stealer venomrat
- StormKitty payload
- VenomRAT
  Detects VenomRAT.
  rat
- Adds Run key to start application
  persistence
behavioral3 behavioral4