asyncrat | VenomClient[.]rar

Sharing

Copy URL

Twitter E-mail

General

Target

VenomClient.rar
Size

183KB
MD5

cbc77b0e97fa86a07b627217f6f3a3bb
SHA1

f8f7ee3e9e49d374ccb553fc152769aa32d3b6ba
SHA256

1c06c3a8b59c5fbe1ffa91f8bc75191fffc8e0f0281ee4ca7899e20e3b6abfb6
SHA512

cbe823df5f13e8ed31708f36af382bc66192e7fe8c487163e226ce024ecdca3029d35570a0cc67c10a8b2cfcf4c12b1ce90a278fe30d3ef1620e96406fe9565a
SSDEEP

3072:jiNcrhOQ5iPkI6jIaVZBjBONAzXhtIz0h3tBbctY4Pm94HS6cNS6q9qEoWjE:nrhOQgPkI6TVDj0NAJd+67OHS6c03qVx

Score

10^/10

rat default asyncrat venomrat

Malware Config

Extracted

Family

asyncrat

Version

Venom RAT + HVNC + Stealer + Grabber v6.0.3

Botnet

Default

Mutex

wgzvrzpksxgiaglrvq

Attributes

c2_url_file
https://paste.ee/r/Wp7LQ/0
delay
1
install
true
install_file
System.exe
install_folder
%AppData%

aes.plain

Signatures

Async RAT payload 1 IoCs

rat

resource	yara_rule
static1/unpack001/Venom Client/Venom.exe	family_asyncrat

Asyncrat family
asyncrat

VenomRAT 1 IoCs

Detects VenomRAT.

rat

resource	yara_rule
static1/unpack001/Venom Client/Venom.exe	VenomRAT

Venomrat family
venomrat

Unsigned PE 3 IoCs

Checks for missing Authenticode signature.

resource
unpack001/Venom Client/Venom.exe
unpack001/Venom Client/freeglut.dll
unpack001/Venom Client/venomsba.dll

Files

VenomClient.rar
.rar
Venom Client/Venom.exe
.exe windows:4 windows x86 arch:x86

f34d5f2d4577ed6d9ceec516c1f5a744

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE

Imports

mscoree

_CorExeMain

Sections

.text
Size: 69KB - Virtual size: 69KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 3KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Venom Client/freeglut.dll
.dll windows:6 windows x64 arch:x64

b70ccfef6881b859fa2bdfff26e23106

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

Imports

opengl32

wglGetCurrentDC
wglDeleteContext
glGetIntegerv
glGetBooleanv
wglMakeCurrent
wglGetCurrentContext
wglCreateContext
wglGetProcAddress
glVertex2i
glRasterPos2i
glPushMatrix
glPushAttrib
glPopMatrix
glPopAttrib
glOrtho
glMatrixMode
glLoadIdentity
glDisable
glColor4fv
glVertex2f
glTranslatef
glPushClientAttrib
glPopClientAttrib
glPixelStorei
glEnd
glBitmap
glBegin
glReadBuffer
glDrawBuffer
glGetString
glGetError
glVertexPointer
glTexCoordPointer
glNormalPointer
glGetFloatv
glEnableClientState
glDrawElements
glDrawArrays
glDisableClientState
glColor4f
glFlush
glViewport

winmm

joyGetPosEx
timeBeginPeriod
timeGetTime
timeEndPeriod
joyGetDevCapsA

kernel32

RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
IsProcessorFeaturePresent
QueryPerformanceCounter
GetCurrentProcessId
BuildCommDCBA
SetCommTimeouts
SetCommState
GetCommTimeouts
GetCommState
CloseHandle
WriteFile
ReadFile
FlushFileBuffers
CreateFileA
GetModuleHandleA
GetCurrentThreadId
GetSystemTimeAsFileTime
DisableThreadLibraryCalls
InitializeSListHead
IsDebuggerPresent

user32

ShowWindow
SetWindowPos
IsIconic
IsZoomed
GetKeyState
GetKeyboardState
ToAscii
SetCapture
ReleaseCapture
MsgWaitForMultipleObjects
UpdateWindow
PostQuitMessage
BeginPaint
EndPaint
GetUpdateRect
InvalidateRect
SetWindowTextA
GetClientRect
GetWindowRect
ChildWindowFromPoint
OffsetRect
GetWindowLongA
SetWindowLongA
MonitorFromWindow
GetMonitorInfoA
SetRect
CopyRect
UnregisterClassA
CreateWindowExA
DestroyWindow
AdjustWindowRectEx
ShowCursor
EnumDisplayMonitors
DefWindowProcA
SendMessageA
GetMessagePos
PeekMessageA
DispatchMessageA
TranslateMessage
GetMessageA
TrackMouseEvent
LoadIconA
GetDesktopWindow
ReleaseDC
GetDC
GetSystemMetrics
GetClassInfoA
SetCursorPos
SetCursor
GetCursorPos
ClientToScreen
ScreenToClient
SetClassLongPtrA
SetActiveWindow
LoadCursorA
ChangeDisplaySettingsExA
EnumDisplaySettingsA
RegisterClassA

gdi32

DescribePixelFormat
SetPixelFormat
GetDeviceCaps
DeleteDC
CreateDCA
ChoosePixelFormat
GetPixelFormat
SwapBuffers

advapi32

RegQueryValueExA
RegOpenKeyA
RegCloseKey
RegOpenKeyExA

vcruntime140

strstr
memcpy
strchr
__std_type_info_destroy_list
__C_specific_handler
memset

api-ms-win-crt-heap-l1-1-0

free
calloc
malloc

api-ms-win-crt-stdio-l1-1-0

__stdio_common_vfprintf
__stdio_common_vsscanf
__stdio_common_vsprintf
__acrt_iob_func

api-ms-win-crt-string-l1-1-0

strtok
_strdup
strcspn
strncmp
strcmp
strncpy

api-ms-win-crt-runtime-l1-1-0

_cexit
_crt_atexit
_seh_filter_dll
_initterm_e
_execute_onexit_table
_initterm
_register_onexit_function
_configure_narrow_argv
_initialize_onexit_table
_initialize_narrow_environment
exit

api-ms-win-crt-math-l1-1-0

cos
sqrt
sin

api-ms-win-crt-environment-l1-1-0

getenv

Exports

Exports

__glutCreateMenuWithExit
__glutCreateWindowWithExit
__glutInitWithExit
glutAddMenuEntry
glutAddSubMenu
glutAppStatusFunc
glutAttachMenu
glutBitmapCharacter
glutBitmapHeight
glutBitmapLength
glutBitmapString
glutBitmapWidth
glutButtonBoxFunc
glutChangeToMenuEntry
glutChangeToSubMenu
glutCloseFunc
glutCopyColormap
glutCreateMenu
glutCreateSubWindow
glutCreateWindow
glutDestroyMenu
glutDestroyWindow
glutDetachMenu
glutDeviceGet
glutDialsFunc
glutDisplayFunc
glutEnterGameMode
glutEntryFunc
glutEstablishOverlay
glutExit
glutExtensionSupported
glutForceJoystickFunc
glutFullScreen
glutFullScreenToggle
glutGameModeGet
glutGameModeString
glutGet
glutGetColor
glutGetMenu
glutGetMenuData
glutGetModeValues
glutGetModifiers
glutGetProcAddress
glutGetWindow
glutGetWindowData
glutHideOverlay
glutHideWindow
glutIconifyWindow
glutIdleFunc
glutIgnoreKeyRepeat
glutInit
glutInitContextFlags
glutInitContextFunc
glutInitContextProfile
glutInitContextVersion
glutInitDisplayMode
glutInitDisplayString
glutInitErrorFunc
glutInitWarningFunc
glutInitWindowPosition
glutInitWindowSize
glutJoystickFunc
glutKeyboardFunc
glutKeyboardUpFunc
glutLayerGet
glutLeaveFullScreen
glutLeaveGameMode
glutLeaveMainLoop
glutMainLoop
glutMainLoopEvent
glutMenuDestroyFunc
glutMenuStateFunc
glutMenuStatusFunc
glutMotionFunc
glutMouseFunc
glutMouseWheelFunc
glutMultiButtonFunc
glutMultiEntryFunc
glutMultiMotionFunc
glutMultiPassiveFunc
glutOverlayDisplayFunc
glutPassiveMotionFunc
glutPopWindow
glutPositionFunc
glutPositionWindow
glutPostOverlayRedisplay
glutPostRedisplay
glutPostWindowOverlayRedisplay
glutPostWindowRedisplay
glutPushWindow
glutRemoveMenuItem
glutRemoveOverlay
glutReportErrors
glutReshapeFunc
glutReshapeWindow
glutSetColor
glutSetCursor
glutSetIconTitle
glutSetKeyRepeat
glutSetMenu
glutSetMenuData
glutSetMenuFont
glutSetOption
glutSetVertexAttribCoord3
glutSetVertexAttribNormal
glutSetVertexAttribTexCoord2
glutSetWindow
glutSetWindowData
glutSetWindowTitle
glutSetupVideoResizing
glutShowOverlay
glutShowWindow
glutSolidCone
glutSolidCube
glutSolidCylinder
glutSolidDodecahedron
glutSolidIcosahedron
glutSolidOctahedron
glutSolidRhombicDodecahedron
glutSolidSierpinskiSponge
glutSolidSphere
glutSolidTeacup
glutSolidTeapot
glutSolidTeaspoon
glutSolidTetrahedron
glutSolidTorus
glutSpaceballButtonFunc
glutSpaceballMotionFunc
glutSpaceballRotateFunc
glutSpecialFunc
glutSpecialUpFunc
glutStopVideoResizing
glutStrokeCharacter
glutStrokeHeight
glutStrokeLength
glutStrokeLengthf
glutStrokeString
glutStrokeWidth
glutStrokeWidthf
glutSwapBuffers
glutTabletButtonFunc
glutTabletMotionFunc
glutTimerFunc
glutUseLayer
glutVideoPan
glutVideoResize
glutVideoResizeGet
glutVisibilityFunc
glutWMCloseFunc
glutWarpPointer
glutWindowStatusFunc
glutWireCone
glutWireCube
glutWireCylinder
glutWireDodecahedron
glutWireIcosahedron
glutWireOctahedron
glutWireRhombicDodecahedron
glutWireSierpinskiSponge
glutWireSphere
glutWireTeacup
glutWireTeapot
glutWireTeaspoon
glutWireTetrahedron
glutWireTorus

Sections

.text
Size: 94KB - Virtual size: 94KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 98KB - Virtual size: 97KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 25KB - Virtual size: 426KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 7KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.gfids
Size: 512B - Virtual size: 16B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

_RDATA
Size: 6KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 5KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Venom Client/venomsba.dll
.dll windows:6 windows x64 arch:x64

b261d0a16bd6de82f63f2deecc4537da

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

Imports

opengl32

glEnable
glVertex3f
glLoadMatrixf
glEnd
glPopAttrib
glDisable
glMatrixMode
glPushAttrib
glOrtho
glGetFloatv
glPushMatrix
glPopMatrix
glColor4f
glScalef
glBegin
glBlendFunc
glLineWidth

kernel32

WriteConsoleW
CreateFileW
HeapSize
SetStdHandle
GetConsoleMode
GetConsoleOutputCP
WriteFile
FlushFileBuffers
GetStringTypeW
GetProcessHeap
FreeEnvironmentStringsW
GetEnvironmentStringsW
WideCharToMultiByte
Beep
VirtualFree
VirtualAlloc
GetSystemInfo
VirtualQuery
HeapCreate
VirtualProtect
HeapFree
GetCurrentProcess
Thread32Next
Thread32First
GetCurrentThreadId
SuspendThread
ResumeThread
CreateToolhelp32Snapshot
Sleep
GetLastError
HeapReAlloc
CloseHandle
HeapAlloc
HeapDestroy
GetThreadContext
GetProcAddress
GetCurrentProcessId
GetModuleHandleW
FlushInstructionCache
SetThreadContext
OpenThread
MultiByteToWideChar
GetCommandLineW
GetCommandLineA
GetCPInfo
GetOEMCP
GetACP
IsValidCodePage
QueryPerformanceCounter
QueryPerformanceFrequency
ReleaseSRWLockExclusive
AcquireSRWLockExclusive
TryAcquireSRWLockExclusive
SleepConditionVariableSRW
GetSystemTimeAsFileTime
WakeAllConditionVariable
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
UnhandledExceptionFilter
SetUnhandledExceptionFilter
TerminateProcess
IsProcessorFeaturePresent
IsDebuggerPresent
GetStartupInfoW
InitializeSListHead
RtlUnwindEx
RtlPcToFileHeader
RaiseException
InterlockedFlushSList
SetLastError
EncodePointer
EnterCriticalSection
LeaveCriticalSection
DeleteCriticalSection
InitializeCriticalSectionAndSpinCount
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
FreeLibrary
LoadLibraryExW
CreateThread
ExitThread
FreeLibraryAndExitThread
GetModuleHandleExW
ExitProcess
GetModuleFileNameW
FlsAlloc
FlsGetValue
FlsSetValue
FlsFree
LCMapStringW
GetStdHandle
GetFileType
SetFilePointerEx
FindClose
FindFirstFileExW
FindNextFileW

user32

FindWindowA
SetWindowTextA
GetAsyncKeyState
GetSystemMetrics
SendInput

Sections

.text
Size: 93KB - Virtual size: 92KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 52KB - Virtual size: 51KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 9KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 6KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 512B - Virtual size: 480B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Extracted

Signatures

Files

f34d5f2d4577ed6d9ceec516c1f5a744

Headers

DLL Characteristics

File Characteristics

Imports

mscoree

Sections

.text Size: 69KB - Virtual size: 69KB

.rsrc Size: 3KB - Virtual size: 3KB

.reloc Size: 512B - Virtual size: 12B

b70ccfef6881b859fa2bdfff26e23106

Headers

DLL Characteristics

File Characteristics

Imports

opengl32

winmm

kernel32

user32

gdi32

advapi32

vcruntime140

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-environment-l1-1-0

Exports

Exports

Sections

.text Size: 94KB - Virtual size: 94KB

.rdata Size: 98KB - Virtual size: 97KB

.data Size: 25KB - Virtual size: 426KB

.pdata Size: 7KB - Virtual size: 6KB

.gfids Size: 512B - Virtual size: 16B

_RDATA Size: 6KB - Virtual size: 5KB

.rsrc Size: 1KB - Virtual size: 1KB

.reloc Size: 5KB - Virtual size: 5KB

b261d0a16bd6de82f63f2deecc4537da

Headers

DLL Characteristics

File Characteristics

Imports

opengl32

kernel32

user32

Sections

.text Size: 93KB - Virtual size: 92KB

.rdata Size: 52KB - Virtual size: 51KB

.data Size: 4KB - Virtual size: 9KB

.pdata Size: 6KB - Virtual size: 5KB

.rsrc Size: 512B - Virtual size: 480B

.reloc Size: 2KB - Virtual size: 1KB

.text
Size: 69KB - Virtual size: 69KB

.rsrc
Size: 3KB - Virtual size: 3KB

.reloc
Size: 512B - Virtual size: 12B

.text
Size: 94KB - Virtual size: 94KB

.rdata
Size: 98KB - Virtual size: 97KB

.data
Size: 25KB - Virtual size: 426KB

.pdata
Size: 7KB - Virtual size: 6KB

.gfids
Size: 512B - Virtual size: 16B

_RDATA
Size: 6KB - Virtual size: 5KB

.rsrc
Size: 1KB - Virtual size: 1KB

.reloc
Size: 5KB - Virtual size: 5KB

.text
Size: 93KB - Virtual size: 92KB

.rdata
Size: 52KB - Virtual size: 51KB

.data
Size: 4KB - Virtual size: 9KB

.pdata
Size: 6KB - Virtual size: 5KB

.rsrc
Size: 512B - Virtual size: 480B

.reloc
Size: 2KB - Virtual size: 1KB