API tools faq
paste
Advertisement
VRad

#remcos_async_venom_130224

VRad
Feb 13th, 2024 (edited)
332
0
Never
Add comment
Not a member of Pastebin yet? Sign Up, it unlocks many cool features!
text 8.01 KB | None | 0 0
raw download clone embed print report
  1. #IOC #OptiData #VR #Remcos #AsyncRAT #VenomRAT #AutoIT #PWD
  2.  
  3. https://pastebin.com/GNZ1JF9A
  4.  
  5. previous_contact:
  6. 25/01/24 https://pastebin.com/cud9xwfs
  7. 19/01/24 https://pastebin.com/EvXHfZUB
  8. 18/01/24 https://pastebin.com/FL2fX362
  9. 25/12/23 https://pastebin.com/D535PVm3
  10. 21/12/23 https://pastebin.com/samYnJq6
  11. 30/11/23 https://pastebin.com/aG6XyqHN
  12. 13/11/23 https://pastebin.com/tbRpiGG5
  13.  
  14. FAQ:
  15. https://malpedia.caad.fkie.fraunhofer.de/details/win.remcos
  16. https://malpedia.caad.fkie.fraunhofer.de/details/win.asyncrat
  17. https://malpedia.caad.fkie.fraunhofer.de/details/win.venom
  18.  
  19. attack_vector
  20. --------------
  21. email URL > bitbucket > GET .7z > .rar (PWD) > .exe1 > .pif > .exe2 > RegAsm.exe > C2
  22.  
  23. # # # # # # # #
  24. email_headers
  25. # # # # # # # #
  26. Date: Tue, 13 Feb 2024 14:41:59 +0300
  27. Subject: Запит № 85305 від: 13.02.2024
  28. From: Отрощенко Панас Світанович <noreply@ system - gps - alert_com>
  29. Reply-To: Федорчук Івантослав Максимович <info@ svenscholten_com>
  30. Received: from out196 - 21_us_a_dm_aliyun_com ([47_90_196_21])
  31. Received: from DESKTOP - TCRDU4C
  32.  
  33. # # # # # # # #
  34. files
  35. # # # # # # # #
  36. SHA-256 6da76fadb53eea635f7facf80d210b66633a9f873fd6ae9ee76ab34a5a14fa75
  37. File name Zapit_Nalog_1302-09_Medoc.7z
  38.  
  39. SHA-256 71677abac5fb8cdbfc3d40c165a0b90b7767aef32c315d7eadaeec6e5cab8735
  40. File name Електронний запит від податкової служби.docx.rar
  41.  
  42. SHA-256 40aa56690dafef35b08b83eebf12c694f5cec88c6ba1ff9f499fff5a5da1ef02
  43. File name Електронний запит від податкової служби.docx.exe
  44.  
  45. SHA-256 412ea561f1fddaab3c4a0543031a61b63e762461e32554e2927e6fc0212ac6cb
  46. File name vns.exe
  47.  
  48. # # # # # # # #
  49. activity
  50. # # # # # # # #
  51.  
  52. PL_SCR bitbucket_org /obmens/file/downloads/ Zapit_Nalog_1302-09_Medoc.7z
  53. bitbucket_org /obmens/file/downloads/ vns.exe
  54.  
  55. C2 Remcos
  56. 77_105_132_92:2404
  57.  
  58. Async/Venom
  59. 77_105_132_94:4449
  60. 77_105_132_94:80
  61. 77_105_132_94:8080
  62. 77_105_132_94:465
  63.  
  64. netwrk
  65. --------------
  66. 77_105_132_92 2404 TCP 49242 → 2404 [SYN]
  67. 77_105_132_94 80 TCP 49245 → 80 [SYN]
  68.  
  69. comp
  70. --------------
  71. Posts.pif 2136 TCP 77_105_132_92 2404 ESTABLISHED
  72. [System Process] TCP 77_105_132_92 2404 ESTABLISHED
  73. RegAsm.exe 3536 TCP 77_105_132_94 80 ESTABLISHED
  74. Posts.pif 2136 TCP 77_105_132_92 2404 ESTABLISHED
  75. RegAsm.exe 3536 TCP 77_105_132_94 80 ESTABLISHED
  76.  
  77. proc
  78. --------------
  79. C:\Users\USER_NAME\Desktop\files1302\Електронний запит від податкової служби.docx.exe
  80. C:\Windows\SysWOW64\cmd.exe move Framed Framed.bat & Framed.bat & exit
  81. C:\Windows\SysWOW64\tasklist.exe
  82. C:\Windows\SysWOW64\findstr.exe /I "avastui.exe avgui.exe nswscsvc.exe sophoshealth.exe"
  83. C:\Windows\SysWOW64\tasklist.exe
  84. C:\Windows\SysWOW64\findstr.exe /I "wrsa.exe opssvc.exe"
  85. C:\Windows\SysWOW64\cmd.exe /c md 9229
  86. C:\Windows\SysWOW64\cmd.exe /c copy /b Graduation + Rp + Negative + Accurate + Bracket 9229\Posts.pif
  87. C:\Windows\SysWOW64\cmd.exe /c copy /b Textbooks + Possible + Coupled 9229\t
  88. C:\TEMP\57020\9229\Posts.pif 9229\t
  89. C:\TEMP\57020\9229\Posts.pif /stext "C:\TEMP\uuejiithfbhhogku"
  90. C:\TEMP\57020\9229\Posts.pif /stext "C:\TEMP\fosbjambbjzurmyggpgg"
  91. C:\TEMP\57020\9229\Posts.pif /stext "C:\TEMP\pqxujtxdpsrzbsmkyztihdj"
  92. C:\TEMP\vns.exe
  93. C:\Windows\SysWOW64\cmd.exe /k move Bathrooms Bathrooms.bat & Bathrooms.bat & exit
  94. C:\Windows\SysWOW64\tasklist.exe
  95. C:\Windows\SysWOW64\findstr.exe /I "avastui.exe avgui.exe nswscsvc.exe sophoshealth.exe"
  96. C:\Windows\SysWOW64\tasklist.exe
  97. C:\Windows\SysWOW64\findstr.exe /I "wrsa.exe opssvc.exe"
  98. C:\Windows\SysWOW64\cmd.exe /c md 9307
  99. C:\Windows\SysWOW64\cmd.exe /c copy /b Compound + Injection + Emotions + Worm 9307\Be.pif
  100. C:\Windows\SysWOW64\cmd.exe /c copy /b Certain + Damages 9307\m
  101. C:\TEMP\15609\9307\Be.pif 9307\m
  102. C:\Windows\SysWOW64\PING.EXE -n 5 localhost
  103. C:\Windows\SysWOW64\PING.EXE -n 5 localhost
  104. C:\Windows\SysWOW64\cmd.exe /k echo [InternetShortcut] > "C:\Users\USER_NAME\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\QuantumGuard.url" & echo URL="C:\Users\USER_NAME\AppData\Local\QuantumSec Systems\QuantumGuard.js" >> "C:\Users\USER_NAME\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\QuantumGuard.url" & exit
  105. C:\Windows\SysWOW64\cmd.exe /c schtasks.exe /create /tn "Legislation" /tr "wscript 'C:\Users\USER_NAME\AppData\Local\QuantumSec Systems\QuantumGuard.js'" /sc minute /mo 3 /F
  106. C:\Windows\SysWOW64\schtasks.exe /create /tn "Legislation" /tr "wscript 'C:\Users\USER_NAME\AppData\Local\QuantumSec Systems\QuantumGuard.js'" /sc minute /mo 3 /F
  107. C:\Windows\SysWOW64\cmd.exe /k echo [InternetShortcut] > "C:\Users\USER_NAME\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\SecureSphereR.url" & echo URL="C:\Users\USER_NAME\AppData\Local\SafeGuard Systems Inc\SecureSphereR.js" >> "C:\Users\USER_NAME\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\SecureSphereR.url" & exit
  108. C:\Windows\SysWOW64\cmd.exe /c schtasks.exe /create /tn "Nt" /tr "wscript 'C:\Users\USER_NAME\AppData\Local\SafeGuard Systems Inc\SecureSphereR.js'" /sc minute /mo 3 /F
  109. C:\Windows\SysWOW64\schtasks.exe /create /tn "Nt" /tr "wscript 'C:\Users\USER_NAME\AppData\Local\SafeGuard Systems Inc\SecureSphereR.js'" /sc minute /mo 3 /F
  110. C:\TEMP\15609\9307\RegAsm.exe
  111.  
  112. persist
  113. --------------
  114. startup_folder
  115.  
  116. QuantumGuard.url c:\users\USER_NAME\appdata\roaming\microsoft\windows\start menu\programs\startup\quantumguard.url 13.02.2024 15:29
  117. target -> C:/Users/USER_NAME/AppData/Local/QuantumSec%20Systems/QuantumGuard.js
  118.  
  119. SecureSphereR.url c:\users\USER_NAME\appdata\roaming\microsoft\windows\start menu\programs\startup\securespherer.url 13.02.2024 15:29
  120. target -> C:/Users/USER_NAME/AppData/Local/SafeGuard%20Systems%20Inc/SecureSphereR.js
  121.  
  122. tasks
  123.  
  124. \Legislation c:\users\USER_NAME\appdata\local\quantumsec systems\quantumguard.js 13.02.2024 15:29
  125.  
  126. \Nt c:\users\USER_NAME\appdata\local\safeguard systems inc\securespherer.js 13.02.2024 15:29
  127.  
  128. drop
  129. --------------
  130. %temp%\vns.exe
  131. %temp%\15609\9307\Be
  132. %temp%\15609\9307\m
  133. %temp%\15609\9307\RegAsm.exe
  134. %temp%\57020\9229\Posts
  135. %temp%\57020\9229\t
  136. %temp%\fosbjambbjzurmyggpgg
  137. %temp%\fwtsqmfile00.sqm
  138.  
  139. C:\Users\USER_NAME\AppData\Local\SafeGuard Systems Inc\*
  140. C:\Users\USER_NAME\AppData\Local\QuantumSec Systems\*
  141. C:\Users\USER_NAME\AppData\Roaming\MyData\DataLogs.conf
  142.  
  143. C:\Users\USER_NAME\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\SecureSphereR.url
  144. C:\Users\USER_NAME\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\QuantumGuard.url
  145.  
  146. # # # # # # # #
  147. additional info
  148. # # # # # # # #
  149. VenomRAT config
  150.  
  151. "Server": "77_105_132_94",
  152. "Ports": "4449,80,8080,465",
  153. "Version": "Venom RAT + HVNC + Stealer + Grabber v6.0.3",
  154. "Autorun": "false",
  155. "Install_Folder": "%AppData%",
  156. "AES_key": "ewzQQkKb2L84tiZEIqI9PQwVg3Do2EXO",
  157. "Mutex": "unqcqotrpzwqx",
  158.  
  159. # # # # # # # #
  160. VT & Intezer
  161. # # # # # # # #
  162. https://www.virustotal.com/gui/url/2ca55c8a4b6400585a465738f31724e78a530ff9ab1836a9e3481f9e860f8540/details
  163. https://www.virustotal.com/gui/file/6da76fadb53eea635f7facf80d210b66633a9f873fd6ae9ee76ab34a5a14fa75/details
  164. https://www.virustotal.com/gui/file/71677abac5fb8cdbfc3d40c165a0b90b7767aef32c315d7eadaeec6e5cab8735/details
  165. https://www.virustotal.com/gui/file/40aa56690dafef35b08b83eebf12c694f5cec88c6ba1ff9f499fff5a5da1ef02/details
  166. https://analyze.intezer.com/analyses/54047516-0e47-45a4-9234-9bef44e933a7/genetic-analysis
  167. https://www.virustotal.com/gui/url/97391e6870d56a89468f4a3e01813f85155ff742efba181f4c36580b9b7ae740/details
  168. https://www.virustotal.com/gui/file/412ea561f1fddaab3c4a0543031a61b63e762461e32554e2927e6fc0212ac6cb/details
  169. https://analyze.intezer.com/analyses/7978e003-0ce7-4672-8bf7-1ab3e8287b7d
  170.  
  171. VR
Advertisement
Add Comment
Please, Sign In to add comment
Advertisement
Public Pastes
Advertisement
We use cookies for various purposes including analytics. By continuing to use Pastebin, you agree to our use of cookies as described in the Cookies Policy.  OK, I Understand
Not a member of Pastebin yet?
Sign Up, it unlocks many cool features!