VenomRAT | Threat Level: high | Type: RAT
Cryptographic Identifiers
| SHA256 | d7de7d851061a99e6f2ca256aba5badf90778f566fc528db6396a4180901ac26 |
|---|---|
| MD5 | 518012e9cbb29d2c1b227064c5663cf7 |
| File Type | js |
| Size | 229.7 KB |
| First Seen | 2026-04-14 |
| File Name | Invoice_PaymentProcessing_INV-26041420-001.js |
| Tags | js, solar-sanat-net, VenomRAT |
Malware Family: VenomRAT
VenomRAT, AsyncRAT türevi RAT'tır.
| Type | RAT |
|---|---|
| Programming Language | C#/.NET |
| Target Platform | Windows |
| C2 Protocol | TCP/SSL |
| Purpose | AsyncRAT türevi |
| First Seen Year | 2020 |
Threat Indicators (IOC)
- SHA256:
d7de7d851061a99e6f2ca256aba5badf90778f566fc528db6396a4180901ac26 - MD5:
518012e9cbb29d2c1b227064c5663cf7
You can verify all hash values of this sample on VirusTotal.
System Cleanup Guide
- Disconnect the system from the network — unplug ethernet, disable Wi-Fi
- Terminate suspicious processes from Task Manager
- Run a full system scan with Malwarebytes or Kaspersky
- HKCU\Software\Microsoft\Windows\CurrentVersion\Run kayıtlarını kontrol edin
- Review newly created tasks in Task Scheduler
- Change all your account passwords from a clean device
- Gerekirse Windows'u yeniden yükleyin ve verilerinizi temiz bir yedeğe geri alın
YARA Rule Hints
rule VenomRAT_SHA256 {
meta:
description = "VenomRAT sample: d7de7d851061a99e"
threat_level = "high"
first_seen = "2026-04-14"
condition:
hash.sha256(0, filesize) == "d7de7d851061a99e6f2ca256aba5badf90778f566fc528db6396a4180901ac26"
}
VenomRAT — Malware Profile
VenomRAT .NET 2021 QuasarRAT fork. golink.com URL shortener C2. AllowSmartScreen bypass. HVNC+keylogger+stealer.
Malware Type
RAT
Programming Language
C#/.NET
C2 Protocol
TCP/SSL
Target Systems
Windows
Capabilities & Behavior
Uzaktan Erişim & Kontrol
Keylogger
Ekran Görüntüsü
Webcam Erişimi
Dosya Yönetimi
Süreç Yönetimi
Komut Yürütme
Kalıcılık Mekanizması
IOC List (2 indicators)
IOC — VenomRAT
# SHA256
d7de7d851061a99e6f2ca256aba5badf90778f566fc528db6396a4180901ac26
# MD5
518012e9cbb29d2c1b227064c5663cf7
| Type | Value | Note |
|---|---|---|
| sha256 | d7de7d851061a99e6f2ca256aba5badf90778f566fc528db6396a4180901ac26 | Sample:VenomRAT |
| md5 | 518012e9cbb29d2c1b227064c5663cf7 | Sample:VenomRAT |