Extracted

• • Target
    _3758bbe67d3bb290e49a4317881084eb64e1e4228af281382059d4ad0e5c11c1.dll
  • Size 782KB
  • SHA256 3758bbe67d3bb290e49a4317881084eb64e1e4228af281382059d4ad0e5c11c1
  • MD5 8928a1914680be4b75afa7dec2181e26
  • SHA1 f87e4992b0fb77cc12e76b518a178d97c6b22578
  • SHA512 b4a54bd0b7d4189de26a864ec694e8193f2d3b4ca9b7515387cd9af4117a277f482381887615380502a792a80beef5c499ae106438b8f32bf8a14934f9e67586
  • SSDEEP 12288:L/fUDx7PzgooMqDOlaJHvNXLuTPRPoqPYa0KwYi5zWmYPhPFL0D+9bHqlIRv/3zT:L/fqPronalaJPpi9no9WphPVi4Hv/jT
  • TLSH
    T1DA050190F69941B4E423C17C94A31706E6B6786C47649FFF47E84A099F6B3C0A43BF62
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultasyncratvenomratratrootkitstealeradwarepersistencespyware

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Family: VenomRAT

    VenomRAT is a modified version of QuasarRAT with some added features, such as rootkit and stealer capabilites.

    ratrootkitstealervenomrat
  • Custom signature

    VenomRAT

    Detects VenomRAT.

    rat

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  • Drops file in System32 directory

  behavioral1behavioral2