arrowrat

Sharing

Copy URL

Twitter E-mail

General

Target

Venom5-HVNC-Rat.zip
Size

16.1MB
Sample

231106-xbs54sda3s
MD5

3a333133b553ea299cab6aea4245e8ea
SHA1

cfa201b7ceee02db2d4cfccb1903b625938b4b5f
SHA256

3dfe4a942287b47f1eb29225788c1b0fc69eb1c1d5acbabd4c10788a2b7d3e52
SHA512

ad582c6f854712bb0b0f703cbb2ca6651b919259eb169bf3892aa32a7f072b5b919fc804345ab5767a21a787bb6ce2cb809d7212074162898dced0185889bdab
SSDEEP

393216:eiJaOLKo7LhMPsyuk/Z4gHodUQgmCkqyTyt:eiMaM/uk/bMwHyGt

Score

10^/10

arrowrat asyncrat %group%agilenet persistence rat

Malware Config

Extracted

Family

arrowrat

Botnet

%Group%

%Hosts%:%Ports%

Mutex

%MTX%

Targets

- Target
  
  Venom5-HVNC-Rat.zip
- Size
  
  16.1MB
- MD5
  
  3a333133b553ea299cab6aea4245e8ea
- SHA1
  
  cfa201b7ceee02db2d4cfccb1903b625938b4b5f
- SHA256
  
  3dfe4a942287b47f1eb29225788c1b0fc69eb1c1d5acbabd4c10788a2b7d3e52
- SHA512
  
  ad582c6f854712bb0b0f703cbb2ca6651b919259eb169bf3892aa32a7f072b5b919fc804345ab5767a21a787bb6ce2cb809d7212074162898dced0185889bdab
- SSDEEP
  
  393216:eiJaOLKo7LhMPsyuk/Z4gHodUQgmCkqyTyt:eiMaM/uk/bMwHyGt
Score

1^/10
behavioral1
- Target
  
  System.Xml.XPath.dll
- Size
  
  20KB
- MD5
  
  415e3ab72f17f10d646b3e2c7a76f612
- SHA1
  
  ed25e94d4e88293345a0f28a5b975159c393b050
- SHA256
  
  24daa1faee0478ba58febe8ee789eb88be0a14d350b57ad8b10690c55976b2e1
- SHA512
  
  55b5c22b87f21df89d0514ae05c9433b65a3c7532845fdfc4c2c5c5e2c3929d70143d84698fdb4dc13ec01895b1022cf0e5e76e12102739530b54150932a7b07
- SSDEEP
  
  384:z6ziqTEkGWvRWtvT1Dm0GftpBjqK4aQHRN7FMlBLY6fMf:zYT1E1DViaLFgYnf
Score

1^/10
behavioral2
- Target
  
  System.Xml.XmlDocument.dll
- Size
  
  21KB
- MD5
  
  328d12af9613b0f3f25320b85dcccbf4
- SHA1
  
  09d02b85a094e925ac3c5d8b1aca096b730c160f
- SHA256
  
  8957f0bcea6ab8a011a53ae62466505199f11a228f87f3809931d974f87078ce
- SHA512
  
  16569ecb727ada36811e72ffc925f07aa21b8a627be45f1eda18cf2b759939591dcafcb2d087596ee903c5abffaf19f56f25e9710ef22874c934cad19537b798
- SSDEEP
  
  384:jUv7c7iWNCWxvT1Dm0GftpBjvaQHRN7KlBLY6fmV:jM7c1R1DVi5LeYpV
Score

1^/10
behavioral3
- Target
  
  System.Xml.XmlSerializer.dll
- Size
  
  21KB
- MD5
  
  d9f02d9f7da653f82e75112a2ab99ce6
- SHA1
  
  bbbb4c2c3911ae1f5ba7faf1d632ed0f14d9b6ac
- SHA256
  
  21493f7f615a099e795f7fae7ecce6082414d1d427790bdf4b103623a3ab34eb
- SHA512
  
  de5546ff103ccc6aa38e254039a372697a193f9c44d0a44f0be3b242d9eef63023dc3fd0c6e8e0d2363177f9230a4e7200d4c32591b398269a1cee9bc47a99fc
- SSDEEP
  
  192:3+vxmNWnRW52bivT1CCjdks/nGfe4pBjSrl1WAaAXcrMHnhWgN7aMW2Mqnaj87Xf:GSWnRWDvT1Dm0GftpBjy7aQHRN7IlZ3U
Score

1^/10
behavioral4
- Target
  
  VenomRAT_HVNC.exe
- Size
  
  16.6MB
- MD5
  
  5384c0396589430eeb3d1a2e05703e9a
- SHA1
  
  20da44da7639bbef2f6b5bfc21df7474cd1109af
- SHA256
  
  b4250aff983f1f588593baed1adb4797e6c1ab6225595ebd013b50348a57a459
- SHA512
  
  9bf613ee62b0e56af500dd88f572b2221ad6df63b0b4c0dcb0ef763efcebeac633a95f10dfce90f6cff038df2810681dd55dcdd272eb9f907c670cc2e4f7363a
- SSDEEP
  
  393216:Al9Yl7Elel7ElAlQleTl/l/l/l/l/lzlml/lqlZlHl/l/l/l/l/l/lIlAl+lUl2L:6TXT
Score

10^/10

asyncrat agilenet rat
- AsyncRat
  AsyncRAT is designed to remotely monitor and control other computers written in C#.
  rat asyncrat
- Async RAT payload
  rat
- Loads dropped DLL
- Obfuscated with Agile.Net obfuscator
  Detects use of the Agile.Net commercial obfuscator, which is capable of entity renaming and control flow obfuscation.
  agilenet
behavioral5
- Target
  
  VenomRAT_HVNC.exe.config
- Size
  
  2KB
- MD5
  
  fa21c166232c3b29f8d2d14557490c9c
- SHA1
  
  2cb1a7d4a204fc03bd6bd15aa9f431f3445a08de
- SHA256
  
  5c939c46f9d81cb75180c897feb5044176ed44cd0d51e076149bd82425e4ef44
- SHA512
  
  cca1dd276a093b62845e5a7652e778d07200b7158cb05a2b44e11e69ce8bc78020eeeb29d55a87a6b87a3fcc25b2883175850467002388a811abfe9945d58fd9
Score

1^/10
behavioral6
- Target
  
  VenomRAT_HVNC.pdb
- Size
  
  927KB
- MD5
  
  2364cc04dedcc2ee6b346b1f2e59eb39
- SHA1
  
  0d024bb95415848661bef34961c1b343803c6dd9
- SHA256
  
  c754a924a7b1df1c44a0dfc330b2e051ef47c03b711e6bf3b499035f3652ad61
- SHA512
  
  24b0006cc7ebe8d45cfa7315fafc0d5cc076d83db080cb9173ea4fe4b3458bccdd571f3cec15eddd00492d8d4309a6020037cf7cb663f1410a01aa202a9dfac5
- SSDEEP
  
  6144:epiFtsuhGqKJoHtsln+kf8odU5hevcgqo685g6NBd37omeaNbksbaQgBw3isVEUJ:WU7Vuft3C85H5Obq
Score

3^/10
behavioral7
- Target
  
  Vestris.ResourceLib.dll
- Size
  
  76KB
- MD5
  
  22fbd571c82399e06e0a7321eedef722
- SHA1
  
  ed5aa859dc8141d93a2bd8a8dd14fc50391b66db
- SHA256
  
  c05a6f13106e2dd10ae279c3435fb63fbabdc328f94d8065231c3cacfff5fc4b
- SHA512
  
  65aa846054a2b0c0dcb2db15273269d8514e000ac67e71542f910d8f556a0ea11e5ab5400b7f2026e5e51fef185d8e12379ac52fa4788c8940727a3721d134d0
- SSDEEP
  
  1536:RS0nOie9ZLjnhULE4ocLF3zqvtm0KMtI9eWG3fL+:M0w9ZPnGLEPc1qvtTKr9eHa
Score

1^/10
behavioral8
- Target
  
  Vestris.ResourceLib.xml
- Size
  
  286KB
- MD5
  
  5d2dee455b4003b6624b6dd890edb279
- SHA1
  
  4cdb025c8c5935bfc49871fca80fc4a346acd579
- SHA256
  
  02b4fd6d46ffc9411e4688a5b088fbc7d34062024e1c93637535e093319c35b6
- SHA512
  
  90f0123b6300a2fe53b7da8b50253c5807950da96dd0010e2494cc9f14d339d7a131c9653f29a585c2647634537cfbc1a1d84debc33a1b96bf7f01b88eaedee9
- SSDEEP
  
  3072:WmVFB8VeEQjvEaXn4chJO2GlUWRLRWIzR:W/VeEQjcaXgdWIzR
Score

1^/10
behavioral9
- Target
  
  bhatrussia.url
- Size
  
  187B
- MD5
  
  96cec2ff3bc1281c3b541d549538c9fb
- SHA1
  
  3080d0f1e71aca0d10925f692c7f700a6fa16d76
- SHA256
  
  cd064a6f7aa46315dea10e6d73bc0416c4954bc8c3fee19a39a2c88c49f3e8ae
- SHA512
  
  bf4798a45851d7c0555474e20d26a6fda8112c9be895f674dea49902b5dc3b4d5d9ce9bc5361f16d9b8508198a3f36733b4991cc72553dad3f698e0e0a87a653
Score

3^/10
behavioral10
- Target
  
  blackhatrussia.url
- Size
  
  187B
- MD5
  
  ef657464ae10c35ee89c6bfb900d83af
- SHA1
  
  1c68b493f87316260e99e3b5b1983fdec0c701b8
- SHA256
  
  cfd230d01d6c362a1005d5a530f1807a65ef8497a1246c43c0dfcd5a62022cbf
- SHA512
  
  80964f8716653eadf15fcea9bfec0800c4beeee6bc1155b421d51fde813d7752f33a6b33622c1f9f4b5c576c168c6f173349caf03f8e76525aa32251c0d340de
Score

3^/10
behavioral11
- Target
  
  cGeoIp.dll
- Size
  
  2.3MB
- MD5
  
  6d6e172e7965d1250a4a6f8a0513aa9f
- SHA1
  
  b0fd4f64e837f48682874251c93258ee2cbcad2b
- SHA256
  
  d1ddd15e9c727a5ecf78d3918c17aee0512f5b181ad44952686beb89146e6bd0
- SHA512
  
  35daa38ad009599145aa241102bcd1f69b4caa55ebc5bb11df0a06567056c0ec5fcd02a33576c54c670755a6384e0229fd2f96622f12304dec58f79e1e834155
- SSDEEP
  
  24576:TRgJE8pkCLLe/K43EnnnclQwIqJY0OjklWXQMFBRpmkL/59ah0USm3uwl00odi9p:TRgfX/59a6USdi9Ues6bV6boLO6r
Score

1^/10
behavioral12
- Target
  
  client.bin
- Size
  
  144KB
- MD5
  
  f4fdcb900e7af47100ac9e46945fbd55
- SHA1
  
  c1d235a9a2cae8d5a8d4f6ceb4eab9417e1b1fb2
- SHA256
  
  9160b90fa4a6a9cf22f943dba92cec64e2dc03c2317b5d9ab50a753fc410ce43
- SHA512
  
  236eef98d4695a5e1224a87a1dc598639e5c49f6dd192a96cc1b9f8305faa57078deb62d73906a33ba1c1fac4fa5ccc5f344a0f196dbba718b76a36667984ac2
- SSDEEP
  
  3072:Bsp9iv+DYM5ob0HGNSKsstcnZTJQDgWPaySsdH5boWz:Op9iTMSb0mgKFcQjhdH
Score

10^/10

arrowrat asyncrat %group%persistence rat
- ArrowRat
  Remote access tool with various capabilities first seen in late 2021.
  rat arrowrat
- AsyncRat
  AsyncRAT is designed to remotely monitor and control other computers written in C#.
  rat asyncrat
- Async RAT payload
  rat
- Modifies Installed Components in the registry
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Suspicious use of SetThreadContext
behavioral13
- Target
  
  dnlib.dll
- Size
  
  1.1MB
- MD5
  
  4d0b771879de85137ee7e5f0d4bb4b16
- SHA1
  
  fc32cccd0cd5c3ebd968bcdf48e32a7ea25e9bd7
- SHA256
  
  962332e8c8cb459fb2f7dacec5d7a618cc53b1b49bc1740156398c89742f43fd
- SHA512
  
  bae39862ea07ebc5c9aa07a7333a880471baf4bf52eebedc03536e45584887eecc1075e0c0171229a54900ab93a66db9f666aa631c160912f538666da8c9e980
- SSDEEP
  
  24576:0eTHIbE7MJp9VuObrLhR4r9gBLKzcWQSv7fwlwhe:U1JoQJR4rm6k
Score

1^/10
behavioral14
- Target
  
  gbpast - Login.url
- Size
  
  107B
- MD5
  
  4a4f5be9370e206241bb73bfc2367f3c
- SHA1
  
  3d837fdcaa5e3bf04b57600cecb56a9ff34dd8f2
- SHA256
  
  210f2ee620fe51acdbe59bba7bb4acbde397034818b09156f6f0874b016a5b18
- SHA512
  
  2ba13fe029ac6c5bcfdecf4f9ff6bdbcd64a1129e845c94944b3b35143b8270b8e024b28302750b2214ef82371a70e59fce4226907af240f60d6ad78fb668054
Score

1^/10
behavioral15
- Target
  
  learn all kind of hacking.url
- Size
  
  121B
- MD5
  
  7ade4a739cbd8f44d0ef52a2f1bc6e7b
- SHA1
  
  20753d483e1a84cb248ba2c0fb72d44137d7d73f
- SHA256
  
  cc7649ed53c65e4851ace414529564fe16801bb2bed4cb15588bfd6b4ac13616
- SHA512
  
  5850c3d064c9d616854a47b4bd398b76494f1fbe9b356ec5e15879f97dc67970168196ec6b177fa71d15d25d25757a29319cbf9697f3a80461aa62b431d53851
Score

1^/10
behavioral16
- Target
  
  netstandard.dll
- Size
  
  96KB
- MD5
  
  0adf6f32f4d14f9b0be9aa94f7efb279
- SHA1
  
  68e1af02cddd57b5581708984c2b4a35074982a3
- SHA256
  
  8be4a2270f8b2bea40f33f79869fdcca34e07bb764e63b81ded49d90d2b720dd
- SHA512
  
  f81ac2895048333ac50e550d2b03e90003865f18058ce4a1dfba9455a5bda2485a2d31b0fdc77f6cbdfb1bb2e32d9f8ab81b3201d96d56e060e4a440719502d6
- SSDEEP
  
  1536:Q2Ec05j4eAH64rh5fSt5T9nFcI94WiVQTjpu:nlK4eA7mDmWqQXpu
Score

1^/10
behavioral17
- Target
  
  packages/Vestris.ResourceLib.2.2.0-beta0004/.signature.p7s
- Size
  
  9KB
- MD5
  
  008690efa5dcb142f17bf7f97461df25
- SHA1
  
  4b56b9178fc8ec56d9f60ee950edbe5379d99c0c
- SHA256
  
  96070f8dc2b0ff9bf0d4ae6b78fba4576ca91eb463ec82587bf2a7d933607104
- SHA512
  
  24174c7689ea03dac11c60a5983c2e2de29a9adb91a1bd0c661252989a604e88215bff647cb0ef8add15901917b2d084a6bfd34a3801fb3d89729e4a457c0390
- SSDEEP
  
  192:IdO7x0KDWpHhXZCVzV07VrKwGDH0JOqsmVgz28WhBqSQcITn:QMvDGGVpzwGoJN77hhLQNTn
Score

7^/10
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Drops file in System32 directory
behavioral18
- Target
  
  packages/Vestris.ResourceLib.2.2.0-beta0004/Vestris.ResourceLib.2.2.0-beta0004.nupkg
- Size
  
  339KB
- MD5
  
  849b21794509f4f0f1e0871e9b414bb1
- SHA1
  
  f6314c42531dfe4a4564d98a67524b2deeca03c7
- SHA256
  
  7296ba826122f5130cbe9f9adf364175a900c34b7803eca7ea4dfee2b0c74ea8
- SHA512
  
  065cbf826a3e98bdfc31a1a3e0f5677ab806ecc17167936dafc53105014972d27956770eabbb9703c867ac7cd4261e8cccb73af634836a84aa64656d4c60c721
- SSDEEP
  
  6144:hgtVRVBHjugfHBnZqnruscW5fHBnZqw9gfbXMfHBnZqx3wH6zogfHBnZq56bIznQ:EVRjjfHqcGfHL9gTMfHUwHIfHaDfHo
Score

3^/10
behavioral19
- Target
  
  packages/Vestris.ResourceLib.2.2.0-beta0004/lib/net20/Vestris.ResourceLib.dll
- Size
  
  76KB
- MD5
  
  2e565b9ecc88100e5815d3fec51311a1
- SHA1
  
  41db669f884a03217eea2d6082912d61f1fc2d23
- SHA256
  
  6861251df743827aad59af9dbc68b4f43b191c2a0857d222d28a82a9e3aa944a
- SHA512
  
  c61b90da4427b5b6005f1b1a7355c6972adfa0ba3818bffeebcdf54f0db13308dcf428455de212b77b22a19b6f41837522a2e316f28daffd71b38276c956c926
- SSDEEP
  
  1536:kkLsIDWIaPX5lY9HEVRKxQzRW7RGROLbGVX01zcEWcO99bzIz+GGlxWgLfUB1m5K:kkL1DWIaPX5lY9HEVRKx2RWtGROLbGVo
Score

1^/10
behavioral20
- Target
  
  packages/Vestris.ResourceLib.2.2.0-beta0004/lib/net20/Vestris.ResourceLib.xml
- Size
  
  286KB
- MD5
  
  5d2dee455b4003b6624b6dd890edb279
- SHA1
  
  4cdb025c8c5935bfc49871fca80fc4a346acd579
- SHA256
  
  02b4fd6d46ffc9411e4688a5b088fbc7d34062024e1c93637535e093319c35b6
- SHA512
  
  90f0123b6300a2fe53b7da8b50253c5807950da96dd0010e2494cc9f14d339d7a131c9653f29a585c2647634537cfbc1a1d84debc33a1b96bf7f01b88eaedee9
- SSDEEP
  
  3072:WmVFB8VeEQjvEaXn4chJO2GlUWRLRWIzR:W/VeEQjcaXgdWIzR
Score

1^/10
behavioral21
- Target
  
  packages/Vestris.ResourceLib.2.2.0-beta0004/lib/net35/Vestris.ResourceLib.dll
- Size
  
  76KB
- MD5
  
  4aa661efcbae2aea7050adbeec022d46
- SHA1
  
  3f1862f14ba7eb63fe3e24a78dc83a51fc676c7b
- SHA256
  
  21e08e7cf51fbe7952f8cf88b924947fd12b01b1ce3405ce2bf6914479f72fc9
- SHA512
  
  dda55ffe2345d3222a2bfdef7ad2f904fcabf3d76aefafb9998ba540bc347491ab9d8b7ee55cc94982544f3a7508952809ad7a159fb0cf62697dffe4edfebe11
- SSDEEP
  
  1536:CkLsIDWIaPX5lY9HEVRKxQzRW7RGROLbGVX01zcEWcO99bzIz+GGlxWgLfUB1m5p:CkL1DWIaPX5lY9HEVRKx2RWtGROLbGVP
Score

1^/10
behavioral22
- Target
  
  packages/Vestris.ResourceLib.2.2.0-beta0004/lib/net35/Vestris.ResourceLib.xml
- Size
  
  286KB
- MD5
  
  5d2dee455b4003b6624b6dd890edb279
- SHA1
  
  4cdb025c8c5935bfc49871fca80fc4a346acd579
- SHA256
  
  02b4fd6d46ffc9411e4688a5b088fbc7d34062024e1c93637535e093319c35b6
- SHA512
  
  90f0123b6300a2fe53b7da8b50253c5807950da96dd0010e2494cc9f14d339d7a131c9653f29a585c2647634537cfbc1a1d84debc33a1b96bf7f01b88eaedee9
- SSDEEP
  
  3072:WmVFB8VeEQjvEaXn4chJO2GlUWRLRWIzR:W/VeEQjcaXgdWIzR
Score

1^/10
behavioral23
- Target
  
  packages/Vestris.ResourceLib.2.2.0-beta0004/lib/net40/Vestris.ResourceLib.dll
- Size
  
  76KB
- MD5
  
  1d4ac765c46e8474583b3bbeba088f74
- SHA1
  
  8f2db7e48158a88d9fa49b888a4b20f93c8b2e0c
- SHA256
  
  3b3c0be681d7603cc1c5e3c5f1d8614a582dd82b2465f7f42d79c5ae57f7f642
- SHA512
  
  cbdca62b58f8855c92edbda5d926787157c16cf46ab5f8d5cad23176fc1157f19531347c4426de5a7e12198eba440ee69d06e46dea1efc6f1e5fab9b4764a5c7
- SSDEEP
  
  1536:GerfdUE9L8kT5j6fk4FhYeuMtIxeTanr+:jfJL825QthrurxeWa
Score

1^/10
behavioral24
- Target
  
  packages/Vestris.ResourceLib.2.2.0-beta0004/lib/net40/Vestris.ResourceLib.xml
- Size
  
  286KB
- MD5
  
  5d2dee455b4003b6624b6dd890edb279
- SHA1
  
  4cdb025c8c5935bfc49871fca80fc4a346acd579
- SHA256
  
  02b4fd6d46ffc9411e4688a5b088fbc7d34062024e1c93637535e093319c35b6
- SHA512
  
  90f0123b6300a2fe53b7da8b50253c5807950da96dd0010e2494cc9f14d339d7a131c9653f29a585c2647634537cfbc1a1d84debc33a1b96bf7f01b88eaedee9
- SSDEEP
  
  3072:WmVFB8VeEQjvEaXn4chJO2GlUWRLRWIzR:W/VeEQjcaXgdWIzR
Score

1^/10
behavioral25
- Target
  
  packages/Vestris.ResourceLib.2.2.0-beta0004/lib/net45/Vestris.ResourceLib.dll
- Size
  
  76KB
- MD5
  
  22fbd571c82399e06e0a7321eedef722
- SHA1
  
  ed5aa859dc8141d93a2bd8a8dd14fc50391b66db
- SHA256
  
  c05a6f13106e2dd10ae279c3435fb63fbabdc328f94d8065231c3cacfff5fc4b
- SHA512
  
  65aa846054a2b0c0dcb2db15273269d8514e000ac67e71542f910d8f556a0ea11e5ab5400b7f2026e5e51fef185d8e12379ac52fa4788c8940727a3721d134d0
- SSDEEP
  
  1536:RS0nOie9ZLjnhULE4ocLF3zqvtm0KMtI9eWG3fL+:M0w9ZPnGLEPc1qvtTKr9eHa
Score

1^/10
behavioral26
- Target
  
  packages/Vestris.ResourceLib.2.2.0-beta0004/lib/net45/Vestris.ResourceLib.xml
- Size
  
  286KB
- MD5
  
  5d2dee455b4003b6624b6dd890edb279
- SHA1
  
  4cdb025c8c5935bfc49871fca80fc4a346acd579
- SHA256
  
  02b4fd6d46ffc9411e4688a5b088fbc7d34062024e1c93637535e093319c35b6
- SHA512
  
  90f0123b6300a2fe53b7da8b50253c5807950da96dd0010e2494cc9f14d339d7a131c9653f29a585c2647634537cfbc1a1d84debc33a1b96bf7f01b88eaedee9
- SSDEEP
  
  3072:WmVFB8VeEQjvEaXn4chJO2GlUWRLRWIzR:W/VeEQjcaXgdWIzR
Score

1^/10
behavioral27
- Target
  
  packages/Vestris.ResourceLib.2.2.0-beta0004/lib/netstandard2.0/Vestris.ResourceLib.dll
- Size
  
  76KB
- MD5
  
  61ddea15b7ac8c8f92893ef321867d27
- SHA1
  
  ea6835a6616f8a3dc07f82eb70111520a7b78c8e
- SHA256
  
  372103129856911388bfea0dc0d6934b645223e3e3e4e8280228abda9382030e
- SHA512
  
  1ee0196a52e50339b9d0fc68036a58f826b2be1095360ef299d2be5bb9a9a56c46f163094c912115f6c80b200caf6bcef74ce6ad45fbb74fb8f80d33d6ac3eb5
- SSDEEP
  
  1536:s6NFUznwH9enK/JRu00SdfOUWz9Mthne5h+fLu:9NX9eYFdWUc9Unen/
Score

1^/10
behavioral28
- Target
  
  packages/Vestris.ResourceLib.2.2.0-beta0004/lib/netstandard2.0/Vestris.ResourceLib.xml
- Size
  
  286KB
- MD5
  
  5d2dee455b4003b6624b6dd890edb279
- SHA1
  
  4cdb025c8c5935bfc49871fca80fc4a346acd579
- SHA256
  
  02b4fd6d46ffc9411e4688a5b088fbc7d34062024e1c93637535e093319c35b6
- SHA512
  
  90f0123b6300a2fe53b7da8b50253c5807950da96dd0010e2494cc9f14d339d7a131c9653f29a585c2647634537cfbc1a1d84debc33a1b96bf7f01b88eaedee9
- SSDEEP
  
  3072:WmVFB8VeEQjvEaXn4chJO2GlUWRLRWIzR:W/VeEQjcaXgdWIzR
Score

1^/10
behavioral29
- Target
  
  protobuf-net.dll
- Size
  
  269KB
- MD5
  
  4a4756e227c10623d81228bc4bc49c1d
- SHA1
  
  964014f538918d85f6eb6a7b4023b304067b28f7
- SHA256
  
  042b8c1c1e0eb7648b164ee48c95168c48324f1fb439cabd5f2e41db0938d807
- SHA512
  
  93d2c6f47c618dc9493f5a538cbfb5a32c1e3bb35a623b51561057245f2fa557c452ee18ae274182c3e0440b77353c5490d196f16eda142b6129e8d1108e5a04
- SSDEEP
  
  3072:2ne8csJldhXG4JhEj9n8RHq6MY7qLfoDb4LUcqbrKKu55O/u85wcT/0c8yiwo3aa:2nT7JxXJ7qFLMrKXE/9YLy1W2WNU6
Score

1^/10
behavioral30
- Target
  
  readme.txt
- Size
  
  740B
- MD5
  
  4dc812ec4ed8b9f6b117eebf783d78cc
- SHA1
  
  4f17b61b3693b3469e61781af895e7e437a6e5ad
- SHA256
  
  8746b7b6305d3fd5d986fab51e9db647319b5673bb96b7d8082e416ab2508b03
- SHA512
  
  92c9215d387f0c29147d69d47f4a07ac1f093504eb14e63160838001d179e164c51efe1459a269a396263edf6bc1c4faea206671591ee728b907506f034c7d15
Score

1^/10
behavioral31
- Target
  
  svchost.exe
- Size
  
  9KB
- MD5
  
  f83c1904404d2b40622d28a5c05420f9
- SHA1
  
  87c629c25b2be94ff603fd4b5e1934541006cc44
- SHA256
  
  58fa8679eb278c0fbe4b9348e61cd274234037af160878289a988260eaf6246e
- SHA512
  
  cb8dedaa9510e466a6babb984913130271baaccc68ccb432e6318e0791547eb6d54d3b61103b9ab39a530d15e6187a580062fe9e5c1442df5d976ee7850448a3
- SSDEEP
  
  192:/vnBrHsNjxAPGuPKm7gfsAq6/apEu74DFRO9e:/vnBrMw+uPK/Pq6/876y9
Score

7^/10
- Drops startup file
behavioral32

MITRE ATT&CK Matrix ATT&CK v13

Tasks

Sharing

General

Malware Config

Extracted

Targets

AsyncRat

Async RAT payload

Loads dropped DLL

Obfuscated with Agile.Net obfuscator

AsyncRat

Async RAT payload

Modifies Installed Components in the registry

Enumerates connected drives

Suspicious use of SetThreadContext

Checks computer location settings

Drops file in System32 directory

Drops startup file

MITRE ATT&CK Matrix ATT&CK v13

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11

behavioral12

behavioral13

behavioral14

behavioral15

behavioral16

behavioral17

behavioral18

behavioral19

behavioral20

behavioral21

behavioral22

behavioral23

behavioral24

behavioral25

behavioral26

behavioral27

behavioral28

behavioral29

behavioral30

behavioral31

behavioral32