Extracted

• • Target

    SecuriteInfo.com.Exploit.Siggen2.64979.12090.18025

  • Size

    75KB

  • MD5

    7ba7817848e5d33a4f5b301b075120d8

  • SHA1

    eacf413cf0b6db5ae2f36149dfd2792812a257f7

  • SHA256

    ccf9c52f4542aceff583c50226397e1f31630836f08ab40759e01eeaa5538ef4

  • SHA512

    06f71b6209b5091f6a16196757b8e3d973872f50d67641dbbd020a500baf19ef8ae018980529a841cb44ba2674e75bd1723605e6ec4a163093523fec389fe8a8

  Score

  10^/10

  venomratevasionpersistenceratrootkitstealertrojan

  • Contains code to disable Windows Defender

    A .NET executable tasked with disabling Windows Defender capabilities such as realtime monitoring, blocking at first seen, etc.

  • Modifies Windows Defender Real-time Protection settings

    evasiontrojan

  • Process spawned unexpected child process

    This typically indicates the parent process was compromised via an exploit or macro.

  • VenomRAT

    VenomRAT is a modified version of QuasarRAT with some added features, such as rootkit and stealer capabilites.

    ratrootkitstealervenomrat

  • Blacklisted process makes network request

  • Executes dropped EXE

  • Adds Run key to start application

    persistence

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2