Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

10

Static

static

10

VenomRAT v...to.dll

windows7-x64

1

VenomRAT v...to.dll

windows10-2004-x64

1

VenomRAT v...nt.exe

windows7-x64

10

VenomRAT v...nt.exe

windows10-2004-x64

10

VenomRAT v...re.dll

windows7-x64

1

VenomRAT v...re.dll

windows10-2004-x64

1

VenomRAT v....2.dll

windows7-x64

1

VenomRAT v....2.dll

windows10-2004-x64

1

VenomRAT v....1.dll

windows7-x64

1

VenomRAT v....1.dll

windows10-2004-x64

1

VenomRAT v....2.dll

windows7-x64

1

VenomRAT v....2.dll

windows10-2004-x64

1

VenomRAT v....1.dll

windows7-x64

1

VenomRAT v....1.dll

windows10-2004-x64

1

VenomRAT v....2.dll

windows7-x64

1

VenomRAT v....2.dll

windows10-2004-x64

1

VenomRAT v...UI.dll

windows7-x64

1

VenomRAT v...UI.dll

windows10-2004-x64

1

VenomRAT v....2.dll

windows7-x64

1

VenomRAT v....2.dll

windows10-2004-x64

1

VenomRAT v...re.dll

windows7-x64

1

VenomRAT v...re.dll

windows10-2004-x64

1

VenomRAT v...re.dll

windows7-x64

1

VenomRAT v...re.dll

windows10-2004-x64

1

VenomRAT v...re.dll

windows7-x64

1

VenomRAT v...re.dll

windows10-2004-x64

1

VenomRAT v....1.dll

windows7-x64

1

VenomRAT v....1.dll

windows10-2004-x64

1

VenomRAT v....2.dll

windows7-x64

1

VenomRAT v....2.dll

windows10-2004-x64

1

VenomRAT v....1.dll

windows7-x64

1

VenomRAT v....1.dll

windows10-2004-x64

1

Analysis

  • max time kernel
    146s
  • max time network
    156s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    08/01/2025, 17:47 UTC

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    VenomRAT v6.0.3_p_/Client.exe

  • Size

    73KB

  • MD5

    5d6802a39c1bea84e1bd3e6ba23b7bbb

  • SHA1

    17b6040dcd0dc6c0cf794b6d95ed4da0f07ef0b9

  • SHA256

    d1fd56cb9943f5b185c8ee52a34f7ea4d34c5091f77ea18138f1d13a8951dd5e

  • SHA512

    55df1ab721022d363b6d454ab496b7cc542702edda0525037cc8f0c33a1d93bc50ed62be8d4b95ba1248d7fee5b806d599ddce5e3ff6a9d4464e3047a0ee799d

  • SSDEEP

    1536:LUUPcxVteCW7PMVee9VdQkhDIyH1bf/mc6QzcajVclNw:LUmcxV4x7PMVee9VdQgH1bfd6QLJY+

Score
10/10
asyncratvenomratdefaultrat

Malware Config

Extracted

Family

asyncrat

Version

Venom RAT + HVNC + Stealer + Grabber v6.0.3

Botnet

Default

C2

93.82.44.26:4040

Mutex

nheplizwdi

Attributes
  • delay

    1

  • install

    false

  • install_folder

    %AppData%

aes.plain
1
X6QMZE5fqOExngKqI9uEH22kSKO3GKmO

Signatures

  • AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat
  • Asyncrat family
    asyncrat
  • VenomRAT 1 IoCs

    Detects VenomRAT.

    rat
  • Venomrat family
    venomrat
  • Suspicious behavior: EnumeratesProcesses 8 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\VenomRAT v6.0.3_p_\Client.exe
    "C:\Users\Admin\AppData\Local\Temp\VenomRAT v6.0.3_p_\Client.exe"
    1⤵
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of SetWindowsHookEx
    PID:3232

Network

  • flag-us
    DNS
    8.8.8.8.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    8.8.8.8.in-addr.arpa
    IN PTR
    Response
    8.8.8.8.in-addr.arpa
    IN PTR
    dnsgoogle
  • flag-us
    DNS
    13.86.106.20.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    13.86.106.20.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    60.153.16.2.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    60.153.16.2.in-addr.arpa
    IN PTR
    Response
    60.153.16.2.in-addr.arpa
    IN PTR
    a2-16-153-60deploystaticakamaitechnologiescom
  • flag-us
    DNS
    2.159.190.20.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    2.159.190.20.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    209.205.72.20.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    209.205.72.20.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    197.87.175.4.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    197.87.175.4.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    198.187.3.20.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    198.187.3.20.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    59.238.56.23.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    59.238.56.23.in-addr.arpa
    IN PTR
    Response
    59.238.56.23.in-addr.arpa
    IN PTR
    a23-56-238-59deploystaticakamaitechnologiescom
  • flag-us
    DNS
    59.238.56.23.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    59.238.56.23.in-addr.arpa
    IN PTR
  • flag-us
    DNS
    241.150.49.20.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    241.150.49.20.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    86.49.80.91.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    86.49.80.91.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    172.210.232.199.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    172.210.232.199.in-addr.arpa
    IN PTR
    Response
  • 93.82.44.26:4040
    Client.exe
    260 B
     5
  • 93.82.44.26:4040
    Client.exe
    260 B
     5
  • 93.82.44.26:4040
    Client.exe
    260 B
     5
  • 93.82.44.26:4040
    Client.exe
    260 B
     5
  • 93.82.44.26:4040
    Client.exe
    260 B
     5
  • 93.82.44.26:4040
    Client.exe
    260 B
     5
  • 93.82.44.26:4040
    Client.exe
    156 B
     3
  • 8.8.8.8:53
    8.8.8.8.in-addr.arpa
    dns
    66 B
     90 B
     1
    1

    DNS Request

    8.8.8.8.in-addr.arpa

  • 8.8.8.8:53
    13.86.106.20.in-addr.arpa
    dns
    71 B
     157 B
     1
    1

    DNS Request

    13.86.106.20.in-addr.arpa

  • 8.8.8.8:53
    60.153.16.2.in-addr.arpa
    dns
    70 B
     133 B
     1
    1

    DNS Request

    60.153.16.2.in-addr.arpa

  • 8.8.8.8:53
    2.159.190.20.in-addr.arpa
    dns
    71 B
     157 B
     1
    1

    DNS Request

    2.159.190.20.in-addr.arpa

  • 8.8.8.8:53
    209.205.72.20.in-addr.arpa
    dns
    72 B
     158 B
     1
    1

    DNS Request

    209.205.72.20.in-addr.arpa

  • 8.8.8.8:53
    197.87.175.4.in-addr.arpa
    dns
    71 B
     157 B
     1
    1

    DNS Request

    197.87.175.4.in-addr.arpa

  • 8.8.8.8:53
    198.187.3.20.in-addr.arpa
    dns
    71 B
     157 B
     1
    1

    DNS Request

    198.187.3.20.in-addr.arpa

  • 8.8.8.8:53
    59.238.56.23.in-addr.arpa
    dns
    142 B
     135 B
     2
    1

    DNS Request

    59.238.56.23.in-addr.arpa

    DNS Request

    59.238.56.23.in-addr.arpa

  • 8.8.8.8:53
    241.150.49.20.in-addr.arpa
    dns
    72 B
     158 B
     1
    1

    DNS Request

    241.150.49.20.in-addr.arpa

  • 8.8.8.8:53
    86.49.80.91.in-addr.arpa
    dns
    70 B
     145 B
     1
    1

    DNS Request

    86.49.80.91.in-addr.arpa

  • 8.8.8.8:53
    172.210.232.199.in-addr.arpa
    dns
    74 B
     128 B
     1
    1

    DNS Request

    172.210.232.199.in-addr.arpa

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/3232-0-0x00007FF864F23000-0x00007FF864F25000-memory.dmp

    Filesize

    8KB

    Download

  • memory/3232-1-0x00000000006A0000-0x00000000006B6000-memory.dmp

    Filesize

    88KB

    Download

  • memory/3232-3-0x00007FF864F20000-0x00007FF8659E1000-memory.dmp

    Filesize

    10.8MB

    Download

  • memory/3232-4-0x00007FF864F23000-0x00007FF864F25000-memory.dmp

    Filesize

    8KB

    Download

  • memory/3232-5-0x00007FF864F20000-0x00007FF8659E1000-memory.dmp

    Filesize

    10.8MB

    Download

We care about your privacy.

This website stores cookies on your computer. These cookies are used to improve your website experience and provide more personalized services to you, both on this website and through other media. To find out more about the cookies we use, see our Privacy Policy.