Static task
static1
Behavioral task
behavioral1
Sample
Venom RAT + HVNC + Stealer + Grabber.exe
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
Venom RAT + HVNC + Stealer + Grabber.exe
Resource
win10v2004-20240704-en
General
-
Target
Venom RAT + HVNC + Stealer + Grabber.exe
-
Size
8.3MB
-
MD5
d3731f0b18e95da5c477cce1c13913ca
-
SHA1
10870da4f1880f7b48ce2530c929f4d5c8760cc1
-
SHA256
a0df1f45f393c5b249f77f57c2647fd80631de1aaa77dbc318ddd853abbdffe5
-
SHA512
3d273cd7bc73fa03d8c498c1ac3d423cac7e23fe266e3a1b32f93ab1e9c29c341e1ae8e1305d310486762998bca2ec8d711698a73428d2180f683ecbd2364865
-
SSDEEP
196608:R4HkUqgBKkUYp81IknE2eZnl5PrT3KUwaUmcmSKgge:2MgBKkUYp81Ik1eZl5jTawUmcmOge
Malware Config
Signatures
-
.NET Reactor proctector 1 IoCs
Detects an executable protected by an unregistered version of Eziriz's .NET Reactor.
resource yara_rule sample net_reactor -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource Venom RAT + HVNC + Stealer + Grabber.exe
Files
-
Venom RAT + HVNC + Stealer + Grabber.exe.exe windows:4 windows x86 arch:x86
f34d5f2d4577ed6d9ceec516c1f5a744
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE
Imports
mscoree
_CorExeMain
Sections
.text Size: 8.3MB - Virtual size: 8.3MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 9KB - Virtual size: 9KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 512B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ