Overview
overview
10Static
static
10VenomCrypt...ib.dll
windows7-x64
1VenomCrypt...ib.dll
windows10-2004-x64
1VenomCrypt...or.exe
windows7-x64
10VenomCrypt...or.exe
windows10-2004-x64
10VenomCrypt...er.exe
windows7-x64
1VenomCrypt...er.exe
windows10-2004-x64
1VenomCrypt...I2.dll
windows7-x64
1VenomCrypt...I2.dll
windows10-2004-x64
1VenomCrypt...or.dll
windows7-x64
1VenomCrypt...or.dll
windows10-2004-x64
1VenomCrypt...er.exe
windows7-x64
10VenomCrypt...er.exe
windows10-2004-x64
10Analysis
-
max time kernel
101s -
max time network
111s -
platform
windows10-2004_x64 -
resource
win10v2004-20231130-en -
resource tags
arch:x64arch:x86image:win10v2004-20231130-enlocale:en-usos:windows10-2004-x64system -
submitted
03-12-2023 13:27
Behavioral task
behavioral1
Sample
VenomCrypter/Core/dnlib.dll
Resource
win7-20231201-en
Behavioral task
behavioral2
Sample
VenomCrypter/Core/dnlib.dll
Resource
win10v2004-20231127-en
Behavioral task
behavioral3
Sample
VenomCrypter/Core/dotnetreactor.exe
Resource
win7-20231023-en
Behavioral task
behavioral4
Sample
VenomCrypter/Core/dotnetreactor.exe
Resource
win10v2004-20231130-en
Behavioral task
behavioral5
Sample
VenomCrypter/Core/venom_crypter.exe
Resource
win7-20231025-en
Behavioral task
behavioral6
Sample
VenomCrypter/Core/venom_crypter.exe
Resource
win10v2004-20231130-en
Behavioral task
behavioral7
Sample
VenomCrypter/Guna.UI2.dll
Resource
win7-20231130-en
Behavioral task
behavioral8
Sample
VenomCrypter/Guna.UI2.dll
Resource
win10v2004-20231127-en
Behavioral task
behavioral9
Sample
VenomCrypter/SimpleObfuscator.dll
Resource
win7-20231023-en
Behavioral task
behavioral10
Sample
VenomCrypter/SimpleObfuscator.dll
Resource
win10v2004-20231127-en
Behavioral task
behavioral11
Sample
VenomCrypter/VenomCrypter.exe
Resource
win7-20231201-en
General
-
Target
VenomCrypter/Core/dotnetreactor.exe
-
Size
14.3MB
-
MD5
44b10b3b38df861e83d7fe0c06414bcd
-
SHA1
fc94d4422602455e01442855c8f35164ef97412d
-
SHA256
0133f4878d4441dad5c153b83b2cb70b510ff089814820cbfb4e88df31564c8e
-
SHA512
00ee844a109cc603c1308b13d4c64a71b076fec41d60f47952f333f1db3c03c389b159c0b13a39f5a4ceefdd1a5212d01c8e5e55db4bdbb8e860788087db4288
-
SSDEEP
196608:fk0F23nFoQ5RPoE72XoQZpChJwa/ThljpYvAksm8jb5HcT6Z:dQ3nFJQE74kpThbpM8JB
Malware Config
Signatures
-
Detect ZGRat V1 1 IoCs
Processes:
resource yara_rule behavioral4/memory/1816-1-0x0000000000970000-0x00000000017C8000-memory.dmp family_zgrat_v1 -
.NET Reactor proctector 1 IoCs
Detects an executable protected by an unregistered version of Eziriz's .NET Reactor.
Processes:
resource yara_rule behavioral4/memory/1816-1-0x0000000000970000-0x00000000017C8000-memory.dmp net_reactor