Overview

overview

10

Static

static

10

7-Venom.exe

windows7_x64

10

7-Venom.exe

windows10_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    7-Venom.exe

  • Size

    625KB

  • Sample

    200815-v2gsdyzjss

  • MD5

    8e0459ea44e2e136a66683b4bb1b9c66

  • SHA1

    e675cd144db3f6adeef99c1d790caae6df4d2b49

  • SHA256

    5e74c2b7ac2d1ad593abac2e47d690a083bf96f1566901e58a5f59d221bc9853

  • SHA512

    257f134d34a6016295e2807e1ff94afb84e25897ae5dd346a8c17e5e28e9dbc130055d22adadfd1f31776d4d62c055d204f3f1293df9c58da2daa9244e2f5059

Score
10/10
venomratevasionratrootkitstealertrojan

Malware Config

Targets

    • Target

      7-Venom.exe

    • Size

      625KB

    • MD5

      8e0459ea44e2e136a66683b4bb1b9c66

    • SHA1

      e675cd144db3f6adeef99c1d790caae6df4d2b49

    • SHA256

      5e74c2b7ac2d1ad593abac2e47d690a083bf96f1566901e58a5f59d221bc9853

    • SHA512

      257f134d34a6016295e2807e1ff94afb84e25897ae5dd346a8c17e5e28e9dbc130055d22adadfd1f31776d4d62c055d204f3f1293df9c58da2daa9244e2f5059

    Score
    10/10
    ratrootkitstealervenomratevasiontrojan

    • Modifies Windows Defender Real-time Protection settings

      evasiontrojan

    • VenomRAT

      VenomRAT is a modified version of QuasarRAT with some added features, such as rootkit and stealer capabilites.

      ratrootkitstealervenomrat

    • Executes dropped EXE

    • Loads dropped DLL

    • Windows security modification

      evasiontrojan

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks