General
-
Target
CryptoJacker.rar
-
Size
10.5MB
-
Sample
240701-qc3ydatare
-
MD5
26d76f2c80f22f59a4fff01dfe086ad3
-
SHA1
3edd1a164997691b146a468cfde71a066f74054a
-
SHA256
9e7c3d6f3fe04cb70a771849581faba1e3c9f913aecc4aa72426741fdf71dee8
-
SHA512
295832d1e83ab949e1b3e5bfe77a28ca4915b37f00e763912c5c26359d48b391f5a1a6fb9574b275c8380d1650216865983218051946f1aae87a68f4a14ee6b0
-
SSDEEP
196608:UctpwG3L4yF7N7LEtfIbJnNMBBd/OquWSeA/oV4Ve+FIUMJsJtT:dtpweLT5/EtAFNoBd/sWS5Q5UMJk5
Static task
static1
Behavioral task
behavioral1
Sample
CryptoJacker.exe
Resource
win7-20240508-en
Behavioral task
behavioral2
Sample
CryptoJacker.exe
Resource
win10v2004-20240508-en
Malware Config
Extracted
asyncrat
Venom RAT + HVNC + Stealer + Grabber v6.0.3
Default
10.0.2.15:9090
10.0.2.15:52033
147.185.221.19:9090
147.185.221.19:52033
yigdzohbebyxyvvzbc
-
delay
1
-
install
true
-
install_file
Steam.exe
-
install_folder
%AppData%
Targets
-
-
Target
CryptoJacker.exe
-
Size
10.6MB
-
MD5
d8a30735aa4702e200ed432d223c3ad8
-
SHA1
fa144148c226a9d08e1d1179cfa60597d4f08cac
-
SHA256
24aeb855ead570407cef3835b4e5ac516e9ec8dd1d0105662727e4f12082b3d2
-
SHA512
cbc030dd159172c2448554393caeb8b0c910d302dec1edc3a719c47be01bb90a4c243d1d15f0cbfebaf0e016cebec7e5c173c4d5cdd27ffdb557716f2071014a
-
SSDEEP
196608:g0Kn9PL3A8tKCn4bwcfAjSNgeQ4ZhseG0j73cQIqW3yiFoNWpPm4Q:/KnZQ4n4Z5Ve0PJIf3rFXdm4Q
Score10/10-
Async RAT payload
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE
-
Loads dropped DLL
-