General
-
Target
SOSA.rar
-
Size
9.9MB
-
Sample
240701-p9q5eashkf
-
MD5
420bbe49e5e5e3af4bc072045d56a13c
-
SHA1
522def8c0708ea6233fe36b7a7edcde4de67baa3
-
SHA256
60207694e5d4fce322f54c781f56945961aefa050d6ea539bb4e2c7c252b724f
-
SHA512
9e19ebee3a85da3f2e0dcb4a0626ae094d1859cdb2ccd3f1ea15fcf72857b89ce85009b841274ff6e0a91daa1aaf35a86dadb53fbbe8f0e6f03afb612f1fd366
-
SSDEEP
196608:Dkkz0Z4TAY3GAcwaoCntlbcqdYhvCa/YHJdNSQIQ+IjoEqlZeImyf4w1AH:v4aAYG9FxWvCa0zSPQ+IkEqXf3g/
Static task
static1
Behavioral task
behavioral1
Sample
SOSA.exe
Resource
win7-20240508-en
Behavioral task
behavioral2
Sample
SOSA.exe
Resource
win10v2004-20240611-en
Malware Config
Extracted
asyncrat
Venom RAT + HVNC + Stealer + Grabber v6.0.3
Default
147.185.221.19:9090
147.185.221.19:54226
127.0.0.1:9090
127.0.0.1:29034
147.185.221.20:9090
147.185.221.20:29034
10.0.2.15:9090
10.0.2.15:52033
147.185.221.19:52033
upqizvsjqe
-
delay
1
-
install
true
-
install_file
Epic Games.exe
-
install_folder
%AppData%
Targets
-
-
Target
SOSA.exe
-
Size
10.3MB
-
MD5
a0f74ad23ce748a132b23889a7151865
-
SHA1
42d2a566db9d318cb0a708f15fbe113942bf0b74
-
SHA256
f0085976b11707aa4c9b57afc33e0bb94612fd31f2541064aff03f8cb85d643d
-
SHA512
157549067ec7bf4593091d4a3bce7222f609493925e4950c908a1348b2194fa2cc51e15e2e25de7d3fcbc2518605e11bdf2d149dc77a55359abe0dac829eafc8
-
SSDEEP
196608:GLpc+BGt3M5CcscVk1OgQRszjQMLwrtUSu+Kuib752HkDOKu3BX4aUvhFC:GWEGa5CcZmQRrUmtUSu9dbV2Exu3Bovm
-
Async RAT payload
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE
-
Loads dropped DLL
-
Adds Run key to start application
-
MITRE ATT&CK Matrix ATT&CK v13
Execution
Command and Scripting Interpreter
1PowerShell
1Scheduled Task/Job
1Scheduled Task
1Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Scheduled Task/Job
1Scheduled Task
1