Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
146s -
max time network
153s -
platform
windows11-21h2_x64 -
resource
win11-20241023-en -
resource tags
-
submitted
24/12/2024, 05:31 UTC
General
-
Target
VenomRAT-V5.6-HVNC/Plugins/Fun.dll
-
Size
36KB
-
MD5
60ec3a7d2b3ad2e295c37d00f7cfbcc9
-
SHA1
3d0a9141b8fe0c35fa6895ac770dc770323ec9e8
-
SHA256
30fb82935718d1bdf5fbd0dd859d17a9797d6a355a944b506349d46b36fcda25
-
SHA512
3450b281454027e6d82cf332290db31c86ed03da7c75143781edebb828d3e3ee112a7794544f4d27bc2964d9d72c9ab2acb706979bbcfb696751312333d1c41a
-
SSDEEP
384:37fLviWK1Xr4GtVmEc6BktslnlrqKQdseXGtrR52bhimwy0Xprnhc4rSf7rpVqK5:LGXFEGtMqS2lnhQk95Z3nhXraDUCEk
Score
1/10
Malware Config
Signatures
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\VenomRAT-V5.6-HVNC\Plugins\Fun.dll,#11⤵
Network
-
DNS23.236.111.52.in-addr.arpaRemote address:8.8.8.8:53Request23.236.111.52.in-addr.arpaIN PTRResponse -
DNS18.173.189.20.in-addr.arpaRemote address:8.8.8.8:53Request18.173.189.20.in-addr.arpaIN PTRResponse
-
DNSocsp.digicert.comRemote address:8.8.8.8:53Requestocsp.digicert.comIN AResponseocsp.digicert.comIN CNAMEocsp.edge.digicert.comocsp.edge.digicert.comIN CNAMEfp2e7a.wpc.2be4.phicdn.netfp2e7a.wpc.2be4.phicdn.netIN CNAMEfp2e7a.wpc.phicdn.netfp2e7a.wpc.phicdn.netIN A192.229.221.95
-
DNS95.221.229.192.in-addr.arpaRemote address:8.8.8.8:53Request95.221.229.192.in-addr.arpaIN PTR
-
DNS95.221.229.192.in-addr.arpaRemote address:8.8.8.8:53Request95.221.229.192.in-addr.arpaIN PTR
-
DNS95.221.229.192.in-addr.arpaRemote address:8.8.8.8:53Request95.221.229.192.in-addr.arpaIN PTR
No results found
-
8.8.8.8:5323.236.111.52.in-addr.arpadns
DNS Request
23.236.111.52.in-addr.arpa
DNS Request
18.173.189.20.in-addr.arpa
DNS Request
ocsp.digicert.com
DNS Response
192.229.221.95
DNS Request
95.221.229.192.in-addr.arpa
DNS Request
95.221.229.192.in-addr.arpa
DNS Request
95.221.229.192.in-addr.arpa