Extracted

Extracted

• • Target

    VenomRAT-V5.6-HVNC/Venom RAT + HVNC.exe

  • Size

    15.5MB

  • MD5

    c9a19172aec8f4d35aabe33d2123d53c

  • SHA1

    24f5dc16f84b7096d2561b628ee22e4aa3fb65a3

  • SHA256

    51505fab78a7b318bcae9d3005fd3035517141abed16054541c29c03bb9af4ea

  • SHA512

    cde593b070d0ea9067651fe107099621c3e1351ad00cf1c641b211fbb4adb380fb83d7a6276cff1e11496f43fc776c603f12ee67aacf0effaf192b4a53199994

  • SSDEEP

    196608:IA5PPrnA5PPr3lAA5PPrJSe6PC7aIahLkNPFCZZwiJl1NLIsPA8fxvuIMzd/95Un:LebljNd60T7P+Zw6NLIsFfskh1BmXG

  Score

  10^/10

  asyncratquasarv15.4.1 | venomvenom clientsdefense_evasiondiscoveryratspywaretrojan

  • AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Asyncrat family

    asyncrat

  • Quasar RAT

    Quasar is an open source Remote Access Tool.

    trojanspywarequasar

  • Quasar family

    quasar

  • Quasar payload

  • Suspicious use of NtCreateUserProcessOtherParentProcess

  • Async RAT payload

    rat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Indicator Removal: Clear Windows Event Logs

    Clear Windows Event Logs to hide the activity of an intrusion.

    defense_evasion

  • Loads dropped DLL

  • Hide Artifacts: Hidden Window

    Windows that would typically be displayed when an application carries out an operation can be hidden.

    defense_evasion

  • Drops file in System32 directory

  • Suspicious use of SetThreadContext

  behavioral1