Overview

overview

10

Static

static

10

d445ced88b...bd.exe

windows7-x64

10

d445ced88b...bd.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    d445ced88bc3e2de34ad6a0636230202ce50a8e22098fc9b9e8fa78f0873f0bd.exe

  • Size

    5.5MB

  • Sample

    240622-bym2qavejq

  • MD5

    9b4a2d9750aaa1b533ff618300d60d2f

  • SHA1

    a205bceff0efe3141810a14fbf4b850355165b92

  • SHA256

    d445ced88bc3e2de34ad6a0636230202ce50a8e22098fc9b9e8fa78f0873f0bd

  • SHA512

    665952e14d1f15d334282aefa7c4b4562bb27d5cb43a86f31c03bb9bbc27d470562aff1d1f7ff800fd6e7cde7e5a160ef9b0da95e69ca62d0909a43a013b9d0e

  • SSDEEP

    98304://vsROSfBa8P9LuKpjO/bmZ4CPVdErgPgPvO63wGxVoz7XJfNCZsD5CR4+xbj://vsX3V1p6bmyCPLCeCwGxILJfNCZsD6

Score
10/10
asyncratlatentbotvenom clientsevasionratthemidatrojan

Malware Config

Extracted

Family

asyncrat

Version

VenomRAT_HVNC 5.0.4

Botnet

Venom Clients

C2

shadpcsverification.zapto.org:4444

Mutex

zhydmgthbwtqr

Attributes
  • delay

    0

  • install

    true

  • install_file

    dddjjjj.exe

  • install_folder

    %AppData%

aes.plain

Extracted

Family

latentbot

C2

shadpcsverification.zapto.org

Targets

    • Target

      d445ced88bc3e2de34ad6a0636230202ce50a8e22098fc9b9e8fa78f0873f0bd.exe

    • Size

      5.5MB

    • MD5

      9b4a2d9750aaa1b533ff618300d60d2f

    • SHA1

      a205bceff0efe3141810a14fbf4b850355165b92

    • SHA256

      d445ced88bc3e2de34ad6a0636230202ce50a8e22098fc9b9e8fa78f0873f0bd

    • SHA512

      665952e14d1f15d334282aefa7c4b4562bb27d5cb43a86f31c03bb9bbc27d470562aff1d1f7ff800fd6e7cde7e5a160ef9b0da95e69ca62d0909a43a013b9d0e

    • SSDEEP

      98304://vsROSfBa8P9LuKpjO/bmZ4CPVdErgPgPvO63wGxVoz7XJfNCZsD5CR4+xbj://vsX3V1p6bmyCPLCeCwGxILJfNCZsD6

    Score
    10/10
    asyncratlatentbotvenom clientsevasionratthemidatrojan

    • AsyncRat

      AsyncRAT is designed to remotely monitor and control other computers written in C#.

      ratasyncrat

    • LatentBot

      Modular trojan written in Delphi which has been in-the-wild since 2013.

      trojanlatentbot

    • Detects executables attemping to enumerate video devices using WMI

    • Detects executables containing the string DcRatBy

    • Detects executables manipulated with Fody

    • Detects executables packed with Themida

    • Identifies VirtualBox via ACPI registry values (likely anti-VM)

      evasion

    • Checks BIOS information in registry

      BIOS information is often read in order to detect sandboxing environments.

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Themida packer

      Detects Themida, an advanced Windows software protection system.

      themida

    • Checks whether UAC is enabled

      evasiontrojan

    • Suspicious use of NtSetInformationThreadHideFromDebugger

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Scheduled Task/Job

1
T1053

Scheduled Task

1
T1053.005

Persistence

Scheduled Task/Job

1
T1053

Scheduled Task

1
T1053.005

Privilege Escalation

Scheduled Task/Job

1
T1053

Scheduled Task

1
T1053.005

Defense Evasion

Virtualization/Sandbox Evasion

1
T1497

Credential Access

Discovery

Query Registry

3
T1012

Virtualization/Sandbox Evasion

1
T1497

System Information Discovery

4
T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Tasks