venomrat | VenomRAT[.]exe | Triage

Sharing

General

Target

VenomRAT.exe
Size

14.0MB
MD5

16cfd8fe9cfd6e1b675ffaab32b799eb
SHA1

3299c389d20420fdc4f92b63de45d6f6ddf3108b
SHA256

e042ba401c8cf5cd2d6adebdb93b5046a7b785ba0b5891140ed449786dac1398
SHA512

e31f6150385e7ffed769b5893760d0529c23c20e6794c63450dfacf8ee864f0febc7e7977952865f499704de903c5acee7c22cae1cf1234ed7c31e5758ae26a5
SSDEEP

196608:Oij6qchgMZX816FU1bYJSg7m7aIchLkNPFCZZwiJl1NLIsPA8fxvuIMzd/95UhSN:3TBP+Zw6NLIsFfskh1BmXG0

Score

10^/10

rat venomrat asyncrat

Malware Config

Signatures

Asyncrat family
asyncrat

VenomRAT 1 IoCs

Detects VenomRAT.

resource	yara_rule
sample	VenomRAT

Venomrat family
venomrat

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
VenomRAT.exe

Files

VenomRAT.exe
.exe windows:4 windows x86 arch:x86

f34d5f2d4577ed6d9ceec516c1f5a744

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Imports

mscoree

_CorExeMain

Sections

.text
Size: 14.0MB - Virtual size: 14.0MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 9KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ