Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Behavioral task
behavioral1
Sample
Venom 2.8 CRACKED - FINAL/VenomRemote_Cracked.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
Venom 2.8 CRACKED - FINAL/VenomRemote_Cracked.exe
Resource
win10v2004-20241007-en
Behavioral task
behavioral3
Sample
Venom 2.8 CRACKED - FINAL/client.exe
Resource
win7-20241010-en
General
-
Target
Venom 2.8 FINAL.zip
-
Size
32.1MB
-
MD5
ff9a466df66361d030a6d61603b9738c
-
SHA1
65e8a96841a329335aacc92d3d2c4fb60f03ad25
-
SHA256
bace996d520f87342bf7ed61cef02607efcda1139d887de18306458eee56d4f8
-
SHA512
d5e2068d3d8b907d8a611beb14390881f71012727ea0dc6395547f3ce43a041a7d239b47bd982aeb9ef7a7583b8b3c37cd91e9c75bf0269d3e82055000491d5e
-
SSDEEP
786432:Nu1uHxf8nFomn63ou9oRB8Tgq6QVxAWOjh:uuHxf8nFomAo5b8TgqSWOjh
Malware Config
Extracted
quasar
-
reconnect_delay
5000
Signatures
-
Quasar family
-
Quasar payload 1 IoCs
resource yara_rule static1/unpack001/Venom 2.8 CRACKED - FINAL/client.bin family_quasar -
Obfuscated with Agile.Net obfuscator 1 IoCs
Detects use of the Agile.Net commercial obfuscator, which is capable of entity renaming and control flow obfuscation.
resource yara_rule static1/unpack001/Venom 2.8 CRACKED - FINAL/VenomRemote_Cracked.exe agile_net -
Unsigned PE 2 IoCs
Checks for missing Authenticode signature.
resource unpack001/Venom 2.8 CRACKED - FINAL/VenomRemote_Cracked.exe unpack001/Venom 2.8 CRACKED - FINAL/client.bin
Files
-
Venom 2.8 FINAL.zip.zip
-
Venom 2.8 CRACKED - FINAL/VenomRemote_Cracked.exe.exe windows:4 windows x86 arch:x86
f34d5f2d4577ed6d9ceec516c1f5a744
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
mscoree
_CorExeMain
Sections
.text Size: 38.4MB - Virtual size: 38.4MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 163KB - Virtual size: 163KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
-
Venom 2.8 CRACKED - FINAL/client.bin.exe windows:4 windows x86 arch:x86
f34d5f2d4577ed6d9ceec516c1f5a744
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
mscoree
_CorExeMain
Sections
.text Size: 904KB - Virtual size: 903KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 3KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
-
Venom 2.8 CRACKED - FINAL/cracked by cortexnet.cc.txt
-
Venom 2.8 CRACKED - FINAL/settings.xml