Extracted

• • Target

    Venom Image Logger v3.1/Venom-main/.editorconfig

  • Size

    158B

  • MD5

    34972a6636960201f371fde437feeb61

  • SHA1

    4c1cac0da96766a730ca654ac96b756489e7125b

  • SHA256

    af6d40deee9e0a2bf5e5bd9e71f857dcdb5c81d5b453425da0616f202b4c679b

  • SHA512

    952e3af7b03fa3f68e4cc18e77c3c7a7795c86a292fa1e0800dc2372e2111107324287f7d95fbae5e1d312d8809e1d84fcbbed9ed2ea1d96890b93f5775f3211

  Score

  3^/10
  behavioral1behavioral2

• • Target

    Venom Image Logger v3.1/Venom-main/Venom.exe

  • Size

    17.8MB

  • MD5

    184d5385057d79ef13d899df4bd19a77

  • SHA1

    fb5d34444109e9c7a6c87b7361f4a05fa9fb7643

  • SHA256

    a6ca738e8be3671c8bd98a967c997e9f14c2fc35a148ecaecb4a3ffb89b895b9

  • SHA512

    36cd4c45e9e5679cb38be18c8556bac30f53a9b50c75147379a58daaded41d93b3511cba77d89d2f10a31ece448268c29e223ab36ff2220fd29944f09bd866e6

  • SSDEEP

    393216:EqPnLFXlrSQ8DOETgsvfGFngYGvEt9T7Gq:lPLFXNSQhEE7f/7

  Score

  10^/10

  discordratpersistencepyinstallerratrootkitstealerupx

  • Discord RAT

    A RAT written in C# using Discord as a C2.

    stealerrootkitratpersistencediscordrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx

  • Legitimate hosting services abused for malware hosting/C2

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  behavioral3behavioral4

• • Target

    Venom Image Logger v3.1/Venom-main/dist/main.exe

  • Size

    17.7MB

  • MD5

    230758495042a4a9fa8babf332440386

  • SHA1

    3eeb7dd97b2369803ac7badebc9a88698850bebc

  • SHA256

    ef5024e4f0920bd936c3e2a9fae11ddde4cef76e646831a98e1a5281c45f30bd

  • SHA512

    4cd1c6f60a293a57bfe8ca900cd8152359e73691e1b10a08d5fd9a8312bac1eb401828d8ccfee50f6b41d2bed4c563c35b1d6d3dfdfdde9b4f6b4e135954c34c

  • SSDEEP

    393216:iqPnLFXlrSQ8DOETgsvfGFngYGvEt9T7Gq:nPLFXNSQhEE7f/7

  Score

  7^/10

  upx

  • Loads dropped DLL

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  behavioral5behavioral6

• • Target

    Venom Image Logger v3.1/Venom-main/src/config.py

  • Size

    192B

  • MD5

    36b6f6034baef719be778b89b1226a6e

  • SHA1

    f02c63ff4ead4a66e375ae8145d409537b302d78

  • SHA256

    70773b420265012d9e1cb9d9bc8a83d8a4ec055d3907bd85102cce4a1853abac

  • SHA512

    67e3164601de145a4ee2888a1772aa8a12cfcc8a2edc995861fd316ab187d9ae3cb0ee36a9094fdb79db8c5d907f50b9dfe88828590285f02c7fd65b5cb6e129

  Score

  3^/10
  behavioral7behavioral8