quasar | Venom 2[.]8 FINAL[.]zip

Sharing

Copy URL Twitter E-mail

General

Target
Venom 2.8 FINAL.zip
Size 32.1MB
Sample240404-pag3fsfd36
SHA256 bace996d520f87342bf7ed61cef02607efcda1139d887de18306458eee56d4f8
MD5 ff9a466df66361d030a6d61603b9738c
SHA1 65e8a96841a329335aacc92d3d2c4fb60f03ad25
SHA512 d5e2068d3d8b907d8a611beb14390881f71012727ea0dc6395547f3ce43a041a7d239b47bd982aeb9ef7a7583b8b3c37cd91e9c75bf0269d3e82055000491d5e
SSDEEP 786432:Nu1uHxf8nFomn63ou9oRB8Tgq6QVxAWOjh:uuHxf8nFomAo5b8TgqSWOjh
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

agilenet quasar

Malware Config

Extracted

Family

quasar

Attributes

reconnect_delay
5000

Signatures

Quasar family
quasar

Quasar payload 1 IoCs

resource	yara_rule
static1/unpack001/Venom 2.8 CRACKED - FINAL/client.bin	family_quasar

Obfuscated with Agile.Net obfuscator 1 IoCs

Detects use of the Agile.Net commercial obfuscator, which is capable of entity renaming and control flow obfuscation.

agilenet

resource	yara_rule
static1/unpack001/Venom 2.8 CRACKED - FINAL/VenomRemote_Cracked.exe	agile_net

Unsigned PE 2 IoCs

Checks for missing Authenticode signature.

resource
unpack001/Venom 2.8 CRACKED - FINAL/VenomRemote_Cracked.exe
unpack001/Venom 2.8 CRACKED - FINAL/client.bin

File Explorer

Venom 2.8 FINAL.zip

.zip 32.1MB
Venom 2.8 CRACKED - FINAL/VenomRemote_Cracked.exe

.exe 38.5MB
Venom 2.8 CRACKED - FINAL/client.bin

.exe 908KB
Venom 2.8 CRACKED - FINAL/cracked by cortexnet.cc.txt

1KB
Venom 2.8 CRACKED - FINAL/settings.xml

475B

Venom 2.8 FINAL.zip

SHA256 bace996d520f87342bf7ed61cef02607efcda1139d887de18306458eee56d4f8
MD5 ff9a466df66361d030a6d61603b9738c
SHA1 65e8a96841a329335aacc92d3d2c4fb60f03ad25
SHA512 d5e2068d3d8b907d8a611beb14390881f71012727ea0dc6395547f3ce43a041a7d239b47bd982aeb9ef7a7583b8b3c37cd91e9c75bf0269d3e82055000491d5e
SSDEEP 786432:Nu1uHxf8nFomn63ou9oRB8Tgq6QVxAWOjh:uuHxf8nFomAo5b8TgqSWOjh
MD5 SHA1 SHA512 SSDEEP

Venom 2.8 CRACKED - FINAL/VenomRemote_Cracked.exe

IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
SHA256 0e59d8a36fc73b40178732c2e9dec9143ceb3dfd590547221dbce65983042141
MD5 83626a159e3399dc2bec680220ba8969
SHA1 c8fb91953976291310ddc645e2b9275277c57ec2
SHA512 6640d88a9aff7507d8372317e34422aa7a493d00194c945c2292d20445e0e0b6a0004ef90e8c263fe683b352292d89b28bdcb5fa4135be4333d4ef7076119f09
SSDEEP 393216:OFdlmXJTD1jJTDQMvfOjmM27kv1Bx0bQox/UlGkNCoIZZJTD2Mm1Zg6YH3mH1gfB:GLxMvDUjCbQa/O11t1Zg6kmH1gEEE
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Obfuscated with Agile.Net obfuscator

Detects use of the Agile.Net commercial obfuscator, which is capable of entity renaming and control flow obfuscation.

agilenet
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

40247902

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

Venom 2.8 CRACKED - FINAL/client.bin

IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
SHA256 540fe401c160e29529b84083108666b3925126ae7681ba11325a6ef3b6613268
MD5 0333674e04906c427f81fe7470e93259
SHA1 13c6fe5d4016cf606f4fe962f2dedc20c9f3b987
SHA512 ee704065dd4289853505d0fb0a0645c949e98be2f93239d912172e5f9edbbb59198494d4581ae43cb9b37ee25fa4d00b65a29431465c9a799b2be5f589f9ad2c
SSDEEP 24576:FD7Y5PaGuEuICcGA60e4yETs5OK1lknB:57Y5PaGuEuICcGA60e4yEg1lk
MD5 SHA1 SHA512 SSDEEP