MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 7b7da08ce864f34537071bd1bfcb8e649ce079c518575d1fdf7fc88a63e98afc. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

SHA256 hash:	7b7da08ce864f34537071bd1bfcb8e649ce079c518575d1fdf7fc88a63e98afc
SHA3-384 hash:	33c3bfc8036253fa55c47e2f9c8f682386cf9eecafb6cbd71867bbd3e0b50dbc8f5f07bd6cddce887d2a0846c28f5d70
SHA1 hash:	3a83244bf4ada3b95f13a8f10e6ad6e71dafbd63
MD5 hash:	e26ca3f0e251a42d708b468f79f810a9
humanhash:	bacon-indigo-sodium-california
File name:	1702653787f369ddd7ca8cebbcaefd07586ccf93e2da0fe5ff68cbac758016b0f4a1d97402770.dat-decoded
Download:	download sample
Signature	VenomRAT Alert Create hunting rule
File size:	75'776 bytes
First seen:	2023-12-15 15:23:10 UTC
Last seen:	Never
File type:	exe
MIME type:	application/x-dosexec
imphash	f34d5f2d4577ed6d9ceec516c1f5a744 (48'744 x AgentTesla, 19'608 x Formbook, 12'242 x SnakeKeylogger)
ssdeep	1536:gUUPcxVteCW7PMVsUT7a3IOE1bh/hTgkJQzcyLVclN:gUmcxV4x7PMVu3E1bhpQjBY
TLSH	T19E735B013BD88D25F2AE4BB9ACF251070EF4D5576116DE8E3CC840CD6A67BC59A037EA
TrID	60.4% (.EXE) Generic CIL Executable (.NET, Mono, etc.) (73123/4/13) 10.8% (.SCR) Windows screen saver (13097/50/3) 8.7% (.EXE) Win64 Executable (generic) (10523/12/4) 5.4% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2) 4.1% (.EXE) Win16 NE executable (generic) (5038/12/1)
Reporter	abuse_ch
Tags:	base64-decoded exe VenomRAT

abuse_ch

Malware dropped as base64 encoded payload

Intelligence

---

File Origin

# of uploads :

1

# of downloads :

356

Origin country :

DE

Vendor Threat Intelligence

CAPE Sandbox

Detection:

n/a

Link:

https://www.capesandbox.com/analysis/467565/

ClamAV Detected

Detection(s):

Win.Packed.Razy-9807129-0

Alert

Create hunting rule

Win.Malware.Generickdz-9865912-0

Alert

Create hunting rule

Win.Trojan.AsyncRAT-9914220-0

Alert

Create hunting rule

Dr. Web vxCube Malware

Result

Verdict:

Malware

Maliciousness:

Behaviour

Creating a file in the %AppData% subdirectories

Сreating synchronization primitives

Creating a window

Sending a custom TCP request

Using the Windows Management Instrumentation requests

Setting a global event handler for the keyboard

FileScan.IO Malicious

Verdict:

Malicious

Threat level:

  10/10

Confidence:

100%

Tags:

anti-debug anti-vm configsecuritypolicy evasive hacktool hook keylogger lolbin mpcmdrun msconfig msiexec njrat rat regedit replace schtasks

Link:

https://www.filescan.io/uploads/657c6f93b2e45ed099be61f7/reports/b9249d97-b59f-4815-918e-e8742a45a0e1/overview

Hybrid Analysis Trojan.Generic

Verdict:

Malicious

Labled as:

Trojan.Generic

Link:

https://www.hybrid-analysis.com/sample/7b7da08ce864f34537071bd1bfcb8e649ce079c518575d1fdf7fc88a63e98afc

InQuest MALICIOUS

Result

Verdict:

MALICIOUS

Details

Windows PE Executable

Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.

Intezer ModernLoader

Malware family:

ModernLoader

Alert

Create hunting rule

Verdict:

Malicious

Link:

https://analyze.intezer.com/analyses/b40c0fae-3d95-490d-ba26-74192a073d72

Joe Sandbox AsyncRAT, VenomRAT

Result

Threat name:

AsyncRAT, VenomRAT

Alert

Create hunting rule

Detection:

malicious

Classification:

troj.spyw.evad

Score:

100 / 100

Link:

https://www.joesandbox.com/analysis/1362730

Signature

.NET source code contains potential unpacker

.NET source code references suspicious native API functions

Antivirus / Scanner detection for submitted sample

Contains functionality to log keystrokes (.Net Source)

Found malware configuration

Machine Learning detection for sample

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for submitted file

Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)

Snort IDS alert for network traffic

Yara detected AsyncRAT

Yara detected VenomRAT

Behaviour

Behavior Graph:

Download SVG

Nucleon Malprob Malware

Score:

99%

Verdict:

Malware

File Type:

PE

Link:

https://malprob.io/report/7b7da08ce864f34537071bd1bfcb8e649ce079c518575d1fdf7fc88a63e98afc

CERT.PL MWDB

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/7b7da08ce864f34537071bd1bfcb8e649ce079c518575d1fdf7fc88a63e98afc/

ReversingLabs TitaniumCloud ByteCode-MSIL.Backdoor.AsyncRAT

Threat name:

ByteCode-MSIL.Backdoor.AsyncRAT

Alert

Create hunting rule

Status:

Malicious

First seen:

2023-12-15 15:24:05 UTC

File Type:

PE (.Net Exe)

Extracted files:

1

AV detection:

21 of 23 (91.30%)

Threat level:

  5/5

Spamhaus Hash Blocklist Suspicious file

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=pn62bdhimtzuknyhdpi37s4omsooa6ofdblv2h67p7eiuy7jrl6a._file

Threatray malicious

Verdict:

malicious

Hatching Triage asyncrat

Result

Malware family:

asyncrat

Alert

Create hunting rule

Score:

  10/10

Tags:

family:asyncrat botnet:default discovery rat

Link:

https://tria.ge/reports/231215-ss15tsfbf9/

Behaviour

Suspicious behavior: EnumeratesProcesses

Suspicious use of AdjustPrivilegeToken

Suspicious use of SetWindowsHookEx

Checks installed software on the system

Async RAT payload

AsyncRat

Malware Config

C2 Extraction:

181.41.200.232:4000

UnpacMe VenomRat INDICATOR_SUSPICIOUS_EXE_WMI_EnumerateVideoDevice win_asyncrat_unobfuscated

Unpacked files

SH256 hash:

7b7da08ce864f34537071bd1bfcb8e649ce079c518575d1fdf7fc88a63e98afc

MD5 hash:

e26ca3f0e251a42d708b468f79f810a9

SHA1 hash:

3a83244bf4ada3b95f13a8f10e6ad6e71dafbd63

Detections:

VenomRat

Alert

Create hunting rule

INDICATOR_SUSPICIOUS_EXE_WMI_EnumerateVideoDevice

Alert

Create hunting rule

win_asyncrat_unobfuscated

Alert

Create hunting rule

Link:

https://www.unpac.me/results/15e4151f-4589-43b7-a7de-8b10a0cc4815/

VMRay Malicious

Verdict:

Malicious

Link:

https://www.vmray.com/analyses/_mb/7b7da08ce864/report/overview.html

VirusTotal

Please note that we are no longer able to provide a coverage score for Virus Total.

YOROI YOMI iSpy Keylogger

Threat name:

iSpy Keylogger

Score:

1.00

Link:

https://yomi.yoroi.company/submissions/7b7da08ce864f34537071bd1bfcb8e649ce079c518575d1fdf7fc88a63e98afc

File information

---

The table below shows additional information about this malware sample such as delivery method and external references.

f369ddd7ca8cebbcaefd07586ccf93e2da0fe5ff68cbac758016b0f4a1d97402

VenomRAT

exe 7b7da08ce864f34537071bd1bfcb8e649ce079c518575d1fdf7fc88a63e98afc

(this sample)

  

Dropped by

SHA256 f369ddd7ca8cebbcaefd07586ccf93e2da0fe5ff68cbac758016b0f4a1d97402

  

Dropped by

MD5 0c2faaf5e0f84adfeaf01c0045509218

  

URLhaus

https://urlhaus.abuse.ch/url/2741207/

  

Delivery method

Distributed via web download

Cape

https://www.capesandbox.com/analysis/467565/