Overview
overview
10Static
static
10Venom-Rat-...ed.exe
windows11-21h2-x64
8Majid Z Hacker.exe
windows11-21h2-x64
8Venom Cracked.exe
windows11-21h2-x64
1Venom-Rat-...ed.exe
windows11-21h2-x64
10Venom Cracked.exe
windows11-21h2-x64
1Venom-Rat-...AT.exe
windows11-21h2-x64
1Venom-Rat-...er.exe
windows11-21h2-x64
1General
-
Target
Venom-Rat-Cracked--main.zip
-
Size
33.8MB
-
Sample
240531-nfg4zaff3v
-
MD5
c8fba8be27bdfbe60de014aaecc83a68
-
SHA1
8c9529de89bd53491e10c3e8c7b35c0d4400e6d1
-
SHA256
f911a357abf083c321d7240e1070b470c9d2a64c1503700dbec45980c88c0aa4
-
SHA512
dfab827a10867022a5833f1af71e5abb3915f792326956ed3859b57b9ef83f6d5cc1b87ffd34c827878289fe581968c75d5f279930ee023ea6496730a86d3c15
-
SSDEEP
786432:Gm20c7pW2y9SIE9lzOG2WMJx+8PxQ4I+zFZx4vFqnb:FqKSIEztoJQ4nzFn4Fqnb
Behavioral task
behavioral1
Sample
Venom-Rat-Cracked--main/Venom Activated Cracked.exe
Resource
win11-20240426-en
Behavioral task
behavioral2
Sample
Majid Z Hacker.exe
Resource
win11-20240426-en
Behavioral task
behavioral3
Sample
Venom Cracked.exe
Resource
win11-20240508-en
Behavioral task
behavioral4
Sample
Venom-Rat-Cracked--main/Venom Software RAT Activated Cracked.exe
Resource
win11-20240426-en
Behavioral task
behavioral5
Sample
Venom Cracked.exe
Resource
win11-20240419-en
Behavioral task
behavioral6
Sample
Venom-Rat-Cracked--main/Venom Software RAT.exe
Resource
win11-20240508-en
Behavioral task
behavioral7
Sample
Venom-Rat-Cracked--main/vncviewer.exe
Resource
win11-20240426-en
Malware Config
Extracted
njrat
0.7d
HacKed
hackerguru.duckdns.org:6666
8b3c87226fd3a4e8b8191141ea7a593c
-
reg_key
8b3c87226fd3a4e8b8191141ea7a593c
-
splitter
|'|'|
Extracted
quasar
-
reconnect_delay
5000
Targets
-
-
Target
Venom-Rat-Cracked--main/Venom Activated Cracked.exe
-
Size
10.1MB
-
MD5
4dabfeed4b250a3248714458ae370ca8
-
SHA1
6e215b2a20039a4dbde18579a1419a4eb10946ac
-
SHA256
eb23cbc820d2b8fdc0227b2e89274edf2671163cae40e0a9bb930b91c05ac3a9
-
SHA512
7ea826cf27da942ce2e9db4a800b3c247670a8fc260af8686d14c48583f38f14b935d5af282a3774a9811f0957ca7318dc883307254554e907f7cfb5f6419a4c
-
SSDEEP
196608:m6+0f/ylacMb5mCbClb12UK4RDx5gRIAL1xXPm68DwOHRR+kc4N4FmDdgW7NaREE:m0f/KacMbR2J2UKEdiRIAL1xXPCwkEn7
Score8/10-
Modifies Windows Firewall
-
Drops startup file
-
Executes dropped EXE
-
Adds Run key to start application
-
-
-
Target
Majid Z Hacker.exe
-
Size
462KB
-
MD5
a8a8d6f3b48466242959545235d1c9b6
-
SHA1
0c2d670dc3b3b07a2498756e1d46fd1fee53a621
-
SHA256
09d709640f6884d6b7e7501175cfdcc3724df07785c081c0e14b20cbcdf382ec
-
SHA512
09f08dd6026b2e24a05e20505723055deceffaba3d351dd49cdc934d038ef0796a3d8d481fe7734b3ec3ba80f4800994983441204dbc3f12baf4f637534a4796
-
SSDEEP
12288:6rs81bE0LfUk6XLbwxMY4R/3CDOpeYYhN7zjYC/M:6H5rh6XPbYuCDOpmPzjZM
Score8/10-
Modifies Windows Firewall
-
Drops startup file
-
Executes dropped EXE
-
Adds Run key to start application
-
Drops autorun.inf file
Malware can abuse Windows Autorun to spread further via attached volumes.
-
-
-
Target
Venom Cracked.exe
-
Size
12.1MB
-
MD5
750015e08a9409c80cd3837daebb970a
-
SHA1
bfd1122f8c459862717b0b7a50b7216fc2573880
-
SHA256
3c413ee4b07c531c891ac1852d3d1b6a60bdc92e549e9cf4744d4fe85ebb5de2
-
SHA512
f35938eac84d6084d9239977462c965bab95924895cd2b73e501a7d7c2ff400aaeaefbdc3302ac8f8c13cd49e22d19e95ef530cf1cc10f79f6ab62653021e5ac
-
SSDEEP
196608:vThKmURVoq/uR12RVoq/uR1bnhmdmARsDymuPP3m:PCd/i14d/i1bn0oAWdG3m
Score1/10 -
-
-
Target
Venom-Rat-Cracked--main/Venom Software RAT Activated Cracked.exe
-
Size
9.8MB
-
MD5
1947749a785b384a9bfe51d57c796ae9
-
SHA1
db986cb4503589a2319e596b799c878ec4d4a990
-
SHA256
6018e4099dca3d452ecc8fe34f5e6d00b2b43c5c21cdea1b4c53c7025376048a
-
SHA512
3e82f60c595a5fc25043729366137ea35f2037bf23b78248cf8946a2edb39c6af4c9159c9c5b6c876148ef8b06468d975a4f6e413319b6ebc9712920f3c5829e
-
SSDEEP
196608:w6+0f/ylacMb5mCbClb12UK4RDx5gRIAL1xXPm68DwOHRR+kc4N4FmDdgW7U:40f/KacMbR2J2UKEdiRIAL1xXPCwkEn3
Score10/10-
Contains code to disable Windows Defender
A .NET executable tasked with disabling Windows Defender capabilities such as realtime monitoring, blocking at first seen, etc.
-
Modifies Windows Firewall
-
Drops startup file
-
Executes dropped EXE
-
Adds Run key to start application
-
Drops autorun.inf file
Malware can abuse Windows Autorun to spread further via attached volumes.
-
-
-
Target
Venom Cracked.exe
-
Size
12.1MB
-
MD5
750015e08a9409c80cd3837daebb970a
-
SHA1
bfd1122f8c459862717b0b7a50b7216fc2573880
-
SHA256
3c413ee4b07c531c891ac1852d3d1b6a60bdc92e549e9cf4744d4fe85ebb5de2
-
SHA512
f35938eac84d6084d9239977462c965bab95924895cd2b73e501a7d7c2ff400aaeaefbdc3302ac8f8c13cd49e22d19e95ef530cf1cc10f79f6ab62653021e5ac
-
SSDEEP
196608:vThKmURVoq/uR12RVoq/uR1bnhmdmARsDymuPP3m:PCd/i14d/i1bn0oAWdG3m
Score1/10 -
-
-
Target
Venom-Rat-Cracked--main/Venom Software RAT.exe
-
Size
12.1MB
-
MD5
750015e08a9409c80cd3837daebb970a
-
SHA1
bfd1122f8c459862717b0b7a50b7216fc2573880
-
SHA256
3c413ee4b07c531c891ac1852d3d1b6a60bdc92e549e9cf4744d4fe85ebb5de2
-
SHA512
f35938eac84d6084d9239977462c965bab95924895cd2b73e501a7d7c2ff400aaeaefbdc3302ac8f8c13cd49e22d19e95ef530cf1cc10f79f6ab62653021e5ac
-
SSDEEP
196608:vThKmURVoq/uR12RVoq/uR1bnhmdmARsDymuPP3m:PCd/i14d/i1bn0oAWdG3m
Score1/10 -
-
-
Target
Venom-Rat-Cracked--main/vncviewer.exe
-
Size
1.3MB
-
MD5
311de77bcdf9808908f628ecd26a098b
-
SHA1
67ad163f8e74c36a702ca9ad721f1bd73574dcd6
-
SHA256
dac7f8191d05a8f2ab0f05c975bae826a2bb4c10bd6b40b0b1be0a260f5cd558
-
SHA512
b2a3e552d6e17a8d4fbe8747ce41423768a3ccb975c496c76291a5f240e011a597b3e3a83175e2387301a72d8c977ab59175bc555e1e706bd5268afdeaf5980b
-
SSDEEP
24576:ba9hax4UZ1uwPKx2pShQTKv/KwEqXpP5fPM8M5lc:CabHKx2kqTKv/pXbPM8M5l
Score1/10 -
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
2Windows Service
2Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
2Windows Service
2