Reddit NetSec

CVE Database V5

AlienVault OTX General

Exploit-DB RSS Feed

Reddit InfoSec News

CIRCL OSINT Feed

ThreatFox MISP Feed

AlienVault OTX Vulnerabilities

AlienVault OTX Malware

A malicious campaign utilizing VenomRAT, a Remote Access Trojan, is analyzed. The attackers use a fake Bitdefender download website to spread malware, including VenomRAT, StormKitty, and SilentTrinity. These tools work together to provide initial access, steal credentials, and maintain long-term hidden access. The campaign's infrastructure includes multiple command and control servers and phishing sites impersonating banks and IT services. The analysis reveals the attackers' focus on harvesting financial credentials and crypto wallets while establishing persistent access for potential exploitation or sale. This campaign highlights the growing trend of sophisticated, modular malware built from open-source components, posing a significant threat to everyday internet users.

The VenomRAT malware campaign represents a sophisticated and modular threat leveraging multiple open-source malware components to achieve initial access, credential theft, and persistent remote access. The campaign uses a fake Bitdefender download website as a lure to distribute VenomRAT alongside other malware such as StormKitty and SilentTrinity. VenomRAT is a Remote Access Trojan (RAT) that allows attackers to control infected systems remotely, while StormKitty is known for credential harvesting, and SilentTrinity facilitates stealthy long-term access and lateral movement. The campaign infrastructure includes multiple command and control (C2) servers and phishing sites impersonating banks and IT services, indicating a focus on financial credential theft and crypto wallet compromise. The attackers employ various techniques mapped to MITRE ATT&CK tactics and techniques such as credential dumping (T1003), input capture (T1056.001), process injection (T1055), obfuscation (T1027), and persistence mechanisms (T1547.001), among others. This modular approach allows attackers to maintain stealth and flexibility, making detection and remediation challenging. The campaign highlights the increasing trend of attackers assembling malware from open-source components, lowering the barrier to entry for sophisticated attacks and increasing the threat surface for everyday internet users and organizations alike.

MD5 of e33b8b32bccfb50f604f06a306d1af89ae7b0d583bca20c41fa5811f526aa420

MD5 of 59a08decb8b960b65afe4d5446ef0e00e3a49ab747599b5ee6e7d43813040287

SHA1 of 59a08decb8b960b65afe4d5446ef0e00e3a49ab747599b5ee6e7d43813040287

SHA1 of e33b8b32bccfb50f604f06a306d1af89ae7b0d583bca20c41fa5811f526aa420

MD5 of 4541fd01a19f1e484f24eff86f42ac36ea9b30686fd405ca0a50f3e517657a61

MD5 of 7c3a49906e67a1928113554ff75f684ee54ab74abcf26ac1211d0cd8726cb086

MD5 of 72b7856f3c6851a36642e952b4fb772b9ea0a6a4075c2ed4b59e60cb922f82e3

MD5 of 68f6ff2543066ec8028d9bc101a17a60c47b693bdc0ee4d6167f17d5d4921ab9

MD5 of eb2b61a5f15b19bf7dd0ff3914d3019c26499dd693647b00c1b073037db72e35

MD5 of f0e479cf0dadc7f7d1f999e091b013d236f2c7959591a6b1268ba31b89442ec6

MD5 of ab81ceeb26e22a7c6981a8479cccaa184675ad194b83e447185a1ce42abfbcb0

MD5 of 2d3dc51e6752c4fe95b2b7928ed11b5e06c6a68d19b7d884ab2c8eaab97d4e07

SHA1 of 72b7856f3c6851a36642e952b4fb772b9ea0a6a4075c2ed4b59e60cb922f82e3

SHA1 of ab81ceeb26e22a7c6981a8479cccaa184675ad194b83e447185a1ce42abfbcb0

SHA1 of 7c3a49906e67a1928113554ff75f684ee54ab74abcf26ac1211d0cd8726cb086

SHA1 of eb2b61a5f15b19bf7dd0ff3914d3019c26499dd693647b00c1b073037db72e35

SHA1 of f0e479cf0dadc7f7d1f999e091b013d236f2c7959591a6b1268ba31b89442ec6

SHA1 of 68f6ff2543066ec8028d9bc101a17a60c47b693bdc0ee4d6167f17d5d4921ab9

SHA1 of 2d3dc51e6752c4fe95b2b7928ed11b5e06c6a68d19b7d884ab2c8eaab97d4e07

SHA1 of 4541fd01a19f1e484f24eff86f42ac36ea9b30686fd405ca0a50f3e517657a61

Detailed information about Inside a VenomRAT Malware Campaign. Get real-time updates, technical details, and mitigation strategies.

Inside a VenomRAT Malware Campaign - Live Threat Intelligence - Threat Radar | OffSeq.com

Inside a VenomRAT Malware Campaign

AsyncRAT, a remote access trojan known since 2019, has been rewritten in Rust, marking a shift from its original C# implementation. This change aims to complicate reverse engineering efforts due to limited analysis tool support for Rust. The malware retains its core functionality, including plugin installation, code execution, and persistence. It installs via scheduled tasks or temporary directory copying, stores plugins in the registry, and communicates with command and control servers over TLS. The Rust variant supports fewer commands compared to its .NET counterpart, suggesting ongoing development. The malware collects system information, including hardware ID, OS details, and antivirus software presence. Debug strings in the samples indicate active development of this Rust version.

AsyncRAT is a remote access trojan (RAT) that has been active since 2019, originally implemented in C#. The recent development involves a significant rewrite of AsyncRAT in the Rust programming language. This transition aims to complicate reverse engineering and malware analysis efforts because Rust currently lacks the mature and widely adopted reverse engineering tools available for C# and .NET binaries. Despite the language shift, the Rust variant retains core functionalities such as plugin installation, arbitrary code execution, and persistence mechanisms. Persistence is achieved by creating scheduled tasks or copying itself into temporary directories. Plugins are stored in the Windows registry, allowing modular expansion of capabilities. Communication with command and control (C2) servers is conducted over TLS-encrypted channels, enhancing stealth and evasion of network detection mechanisms. The Rust variant currently supports fewer commands than its predecessor, indicating it is under active development and may expand capabilities over time. The malware collects detailed system information, including hardware identifiers, operating system details, and the presence of antivirus software, which can be used for environment reconnaissance and tailoring attacks. Debug strings found in samples confirm ongoing development efforts. Indicators of compromise (IOCs) include specific file hashes and domains used for C2 communication, such as backup-tlscom.sytes.net, magic-telecom.ddns.net, and mohsar.ddns.net. No known exploits leveraging this Rust variant are reported in the wild yet, and the threat is assessed at a medium severity level due to its evolving nature and potential for stealthy persistence and control.

Detailed information about Reborn in Rust: Attempt to thwart malware analysis. Get real-time updates, technical details, and mitigation strategies.

Title	Severity	Type	Source	Date

Threats Tagged 'command and control'

Filter Threats

Threats Tagged 'command and control'

Keyboard Shortcuts

Navigation

Search & Filters

UI Controls

Accessibility