Extracted

• • Target

    VenomServer.exe

  • Size

    93KB

  • MD5

    2f730ef80818f9cc2e2a592badc24d2b

  • SHA1

    d5d4d56727eb252067f4e67aa6658a2ba461a919

  • SHA256

    727785cc92095e9d516041ac06b779e5beb08cd5b9f62716ac68651b673862ad

  • SHA512

    ae8bbc90038e1cbc0eda7181fc190c7f87baedcb5f522d93309774b60b7d82a743896c3bd628badd3c851a80811c1dc278de3a9111a48995ea976b817c4e63e7

  • SSDEEP

    1536:3VwC+xhUa9urgOBPRNvM4jEwzGi1dDwDzgS:3VmUa9urgObdGi1des

  Score

  8^/10

  discoveryevasionpersistenceprivilege_escalation

  • Disables Task Manager via registry modification

    evasion

  • Modifies Windows Firewall

    evasion

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Drops autorun.inf file

    Malware can abuse Windows Autorun to spread further via attached volumes.

  behavioral1