Overview

overview

10

Static

static

10

77-Venom.exe

windows7_x64

10

77-Venom.exe

windows10_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    77-Venom.exe

  • Size

    576KB

  • Sample

    200815-1gc48vskrx

  • MD5

    a4a92cfdc1b3a949970eb6f5b20e1f21

  • SHA1

    6f46b5386bb1cdcf83861666ddeb2be02ae7ee5f

  • SHA256

    e83d13fcdc0f133482d558c8ce25b45a491ba3aff13849ce8169f05bb4972f0d

  • SHA512

    8b9153e6ab420e088de44005f5bc8d335ae83ad2b7705802c6140cd407df6a6f690adb172806846e39ce2a899ea849520a0b71c2a7057cf5adb58df436369447

Score
10/10
quasarvenomratevasionratrootkitspywarestealertrojan

Malware Config

Targets

    • Target

      77-Venom.exe

    • Size

      576KB

    • MD5

      a4a92cfdc1b3a949970eb6f5b20e1f21

    • SHA1

      6f46b5386bb1cdcf83861666ddeb2be02ae7ee5f

    • SHA256

      e83d13fcdc0f133482d558c8ce25b45a491ba3aff13849ce8169f05bb4972f0d

    • SHA512

      8b9153e6ab420e088de44005f5bc8d335ae83ad2b7705802c6140cd407df6a6f690adb172806846e39ce2a899ea849520a0b71c2a7057cf5adb58df436369447

    Score
    10/10
    ratrootkitstealervenomratevasiontrojanspywarequasar

    • Modifies Windows Defender Real-time Protection settings

      evasiontrojan

    • Quasar RAT

      Quasar is an open source Remote Access Tool.

      trojanspywarequasar

    • VenomRAT

      VenomRAT is a modified version of QuasarRAT with some added features, such as rootkit and stealer capabilites.

      ratrootkitstealervenomrat

    • Executes dropped EXE

    • Loads dropped DLL

    • Windows security modification

      evasiontrojan

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    • Drops file in System32 directory

    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks