ef0194d9f080eeff5fcf1f53a04820194a17ea8201f213c2716629e8d72f96b2

Sharing

Copy URL Twitter E-mail

General

Target
VenusAI-Setup-1.2.3.exe
Size 24.1MB
Sample261027-snr2csdh28
SHA256 ef0194d9f080eeff5fcf1f53a04820194a17ea8201f213c2716629e8d72f96b2
MD5 9c0644afcf7b28d11ead5b9f2acca77c
SHA1 80da0275c0dbc60f80e5f0c46fd1640a3b549741
SHA512 951068e89c80cedbff582527917d772f62fb7d82a7dbd785f2331653697f11ef1388543f5a3ff22837de3bc5384f7e48e330fb9b16fd93413318f9c0e572b418
SSDEEP 786432:uNKnJE4FMh5oGB2N94lOfOkfAC0mItbtEomZ:uNf4FO5o19z2kfAC0xtCJ
TLSH
T1EB473390D7FCBBBDF474473A05EA53286F102316E996E52024B9463CBC0AED6839ED53
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

Malware Config

Targets

- Target
  VenusAI-Setup-1.2.3.exe
- Size 24.1MB
- SHA256 ef0194d9f080eeff5fcf1f53a04820194a17ea8201f213c2716629e8d72f96b2
- MD5 9c0644afcf7b28d11ead5b9f2acca77c
- SHA1 80da0275c0dbc60f80e5f0c46fd1640a3b549741
- SHA512 951068e89c80cedbff582527917d772f62fb7d82a7dbd785f2331653697f11ef1388543f5a3ff22837de3bc5384f7e48e330fb9b16fd93413318f9c0e572b418
- SSDEEP 786432:uNKnJE4FMh5oGB2N94lOfOkfAC0mItbtEomZ:uNf4FO5o19z2kfAC0xtCJ
- TLSH
  T1EB473390D7FCBBBDF474473A05EA53286F102316E996E52024B9463CBC0AED6839ED53
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

7^/10

defense_evasion discovery trojan
- Executes dropped EXE
- Loads dropped DLL
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
- Checks whether UAC is enabled
  defense_evasion trojan
- Network Share Discovery
  Attempt to gather information on host network.
  discovery
behavioral1 behavioral2
- Target
  $PLUGINSDIR/MicrosoftEdgeWebview2Setup.exe
- Size 1.8MB
- SHA256 ca4c9016c70e2184c5e231662e0e98abf4826647180ef3faab32fcb1ca2ec15e
- MD5 33d13c497e92edc89b87ba58f86bda3c
- SHA1 cd64da2d5b01262aed926148947b061b0e40e377
- SHA512 982dd2f134f7fa9302c16fd7602a8077063e4693727a65863172542d15115e8c924b2b2425870d37b1f0877492546c0549177cbba776833c03e6c283d179d766
- SSDEEP 49152:wiGZ397s0oSJJy9ywOGLAe57EGQnfqXQnKCFnT4eTGwEeB3I:wi4QMJWt/OFnACFnd423I
- TLSH
  T1E0952311B5E88035F2B32E3159F49AB20A7EBC729F7555CB13811E1E1D31AE2D335B2A
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

6^/10

defense_evasion discovery persistence privilege_escalation
- Event Triggered Execution: Image File Execution Options Injection
  persistence
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Event Triggered Execution: Component Object Model Hijacking
  Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
  persistence privilege_escalation
behavioral3 behavioral4
- Target
  $PLUGINSDIR/System.dll
- Size 12KB
- SHA256 afe032f942e2ed0bf7494ec08ba813f5739fb522c640bde81d30ecaf9f894432
- MD5 564e01f2c6edfb8475573e1b809cb5eb
- SHA1 5d767e8f685449d86cd8d16c83a814ef8f7d6264
- SHA512 67486f8e996b29688cfb5a57ae4a7604fa0892ba0eeccdd55f514ca4bd9b79a6fe42bfab4fc85156c2258ae66539bdd9bb36a8b5f7f944f3007c2421f244c95c
- SSDEEP 192:rjHcQ0qWTlt7wi5Aj/lM0sEWD/wtYbBjpNQybC7y+XZ80QPi:X/Qlt7wiij/lMRv/9V4b8r
- TLSH
  T1FD426C1297B089F2F551493419667F2A6FBEAC5D27F405A3CFE304C63D212DB9879243
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral5 behavioral6
- Target
  $PLUGINSDIR/nsDialogs.dll
- Size 9KB
- SHA256 9c76f4d53ceee2a471c936e0899688405e1009ce962d140e9acb49ed68d114cb
- MD5 79c27de4d1c6d295fefaa70f608f1c67
- SHA1 feba90c93db3fedd450a81eb2603f793332d1a83
- SHA512 fbd79f3946032821584ea2fa4b559ac5809ab45fdc9107eb47c9ff3fa3229d7748a7b2ed588709e59cce16a4f8e58ed98b46cb061acf1080e78434d184f51ec7
- SSDEEP 96:oQEv02zUu56FcS817eTaXx85qHFcUcxSgB5PKtAtoniJninnt3DVEB3YbNqkzfFc:oQEvCu5e81785qHFcU0PuAw0uyBIFc
- TLSH
  T1E612E892A2A454B3C5D6523B35AA2F2DCBBD5329B0927C01C7738E4D39395766E38343
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral7 behavioral8
- Target
  $PLUGINSDIR/nsExec.dll
- Size 7KB
- SHA256 1dee37f6abb2dec9e767bd022d29386b6b295bbd55bf316d2649b8d298f89e9d
- MD5 879b0aab93b11228a27d6b2e498b95be
- SHA1 f5024d0d44c37443d7c17f1ff80fba301389ed42
- SHA512 427ddc4c01be77dd28a376a78714f5004edbee2df6662500cf11d2f4309fdf9a126d7632a7afd0e28712e851eabf56d9d469eb2f3b6c645923d3476275d6eff6
- SSDEEP 192:JZFon9Dar9s7hdD8oZc41Zf0NQZGdH6E:RonlarK3orqf0NQZGdH
- TLSH
  T1FFE1E93571C02DF3D08A4A717D26B92B83F89826277741708B771AD979E0AE7FD24742
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral10 behavioral9
- Target
  VenusAI.exe
- Size 49.4MB
- SHA256 ee1b3c24cb5352af0edc9499cf5da715ad3ee8ff24c9c5e603edb992bfa4eea1
- MD5 3eb71d722dfe96d33d21bd6a47ccd9cd
- SHA1 513f23acccca889ded7a4f8d3d210b20c846a7ea
- SHA512 a95aa586fd69cbd257ea6d61e74c828d911effffbba587afe0b3c8fd69f0713dff43eaec8e3778020a933f5e0cda97ff74dd04b5d17b023b4c1da6eb312d96a3
- SSDEEP 196608:0KLryRADH4vAdXKwa1hXN7PRKRt3J7kWxMmmcHFLWPIx0iad0CASQDoDey98R2Sj:0KWyZl0N727kWqc8PIx1acox973/tSb
- TLSH
  T1E9B75A03F5264496E458D432451B9B367F217844636033EBAB78F6AD2DBBBD039BB720
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

6^/10

defense_evasion discovery trojan
- Checks whether UAC is enabled
  defense_evasion trojan
- Network Share Discovery
  Attempt to gather information on host network.
  discovery
behavioral11
- Target
  VenusUninstall.exe
- Size 13.4MB
- SHA256 907ba66fcb13f89ee21e0c592957959dbad23c22cb05543d97168ee4f9643258
- MD5 3fb06fcc13267db64cff7bb1d8a083a7
- SHA1 c0c81759f817bdd5d03d470d78b385f367a680f2
- SHA512 b6af6082fe13798e4d0ae863b1124188762ab7612a7ceadaf90217aa345f36fca5b3fad965716e728d25200cda5409437a3ab1635b1af439bd00e72940c542ca
- SSDEEP 98304:hPjyE1h4Snn33ns88+kPSrVB6P1HP+lyWaWX0XG6U1teyElOJxJF9dZDLNhkOIEL:IK/nnsH7QstWlC6nNjXDLQOx9ma
- TLSH
  T1A6E65A43FDA510E4C0AEC53489A69222BB71BC491B352BD71B50B2347F73BD4AEBA354
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

7^/10

defense_evasion discovery trojan
- Executes dropped EXE
- Checks whether UAC is enabled
  defense_evasion trojan
- Network Share Discovery
  Attempt to gather information on host network.
  discovery
behavioral12