Overview

overview

10

Static

static

10

VenomRAT.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    VenomRAT.zip

  • Size

    2.7MB

  • Sample

    240309-kh5fhafb3s

  • MD5

    78870c277a959c207991b9af55e8b3db

  • SHA1

    dfd571fec1275eb9d57f6bedc81f6084666d712a

  • SHA256

    bed566efa17d36676370408a804d916195a9dcd86e8eda8b5c279b4c84a527f2

  • SHA512

    c0e4c358775c8d34192bbf11fcfc57360d23b89bffcacd5e9c50b1c3550162d797261ad8e8f9807023b7b606f400bab075aac1950900fe452f457cba232c5a0a

  • SSDEEP

    49152:q3z5cQkHNtWRbwuHhlB9MOXevldPI5GPgDzPc8joCcnNCXMVrSaeODSRXZCnc0MQ:Y3k/W1bHbMOX4ldg5FzP3HXMNS1Rpyc0

Score
10/10
lucastealerspywarestealer

Malware Config

Extracted

Family

lucastealer

C2

https://api.telegram.org/bot5428876226:AAFBchyLgjGmB_WG7TBXAtjIewC0an-KRm4

Targets

    • Target

      VenomRAT.exe

    • Size

      5.4MB

    • MD5

      b0dab6cd0e9d35492253d0f52e141500

    • SHA1

      0c8f2b5d5212c33aed8dae3aa63dc2cb77e3b33f

    • SHA256

      e1e909014437724aba43b2aa8e47aa01e56d6d47f5f37d883000d5f42e763a4c

    • SHA512

      2f656e396bc76656a33cc21e38bf55f811bbcb9dc19784298110ba0e86302055adfb891433b63a37ae9c8911e884974f5c2a6d5f5c6ad0d725aed2e0f30c82b4

    • SSDEEP

      49152:WTiGhIjd1axByJUhitEbL4I+j9+qDKai8mnbqFt4048ZDYOfkCFZ+XYvgp2h3tUd:W/hNLOI2uKHKJgJ+B+t

    Score
    10/10
    lucastealerspywarestealer

    • Luca Stealer

      Info stealer written in Rust first seen in July 2022.

      stealerlucastealer

    • Deletes itself

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer

    • Accesses cryptocurrency files/wallets, possible credential harvesting

      spyware

    • Enumerates connected drives

      Attempts to read the root path of hard drives other than the default C: drive.

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    behavioral1

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Unsecured Credentials

2
T1552

Credentials In Files

2
T1552.001

Discovery

Query Registry

1
T1012

Peripheral Device Discovery

1
T1120

System Information Discovery

1
T1082

Lateral Movement

Collection

Data from Local System

2
T1005

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Tasks