Loading malware…
VenomRAT is a commodity Windows remote access trojan derived from the QuasarRAT/AsyncRAT lineage and commonly described as a descendant of DcRAT. Written in C# for the .NET Framework, it has been used by multiple cybercriminal actors since at least 2020 and has appeared frequently in broad email-borne malware campaigns. It provides full remote control of compromised systems and supports information gathering, command execution, data exfiltration, lateral movement, and delivery of additional payloads. Some variants have also been reported to include ransomware functionality.
VenomRAT has evolved beyond a basic Quasar-style clone by incorporating stronger evasion and host-control features. Reported capabilities include keylogging, hardware and software reconnaissance, process enumeration, webcam access, anti-monitoring logic that terminates selected security and administrative tools, and in-memory bypasses for AMSI and ETW. It also uses dynamic API resolution and process injection techniques, including observed deployment into legitimate Windows processes, to reduce detection and hinder analysis.
The malware is distributed through multiple criminal delivery ecosystems rather than a single exclusive operator. Observed infection vectors include phishing campaigns, especially invoice- and tax-themed lures, malicious JavaScript and PowerShell download chains, abuse of trusted services such as Dropbox and TryCloudflare, and malicious PDF lures that exploit Foxit Reader behavior to trick users into launching external commands. VenomRAT has also been delivered alongside or interchangeably with other commodity RATs such as AsyncRAT, XWorm, Remcos, and njRAT. Proofpoint reporting has identified TA558 as a major historical distributor, with additional use by TA2541 and other unattributed clusters.
VenomRAT has been widely treated as part of the broader AsyncRAT/DcRAT malware family ecosystem, whose forks often retain recognizable inherited certificate metadata on command-and-control infrastructure. The malware’s operational footprint and criminal ecosystem significance led to international law-enforcement disruption under Operation Endgame, including infrastructure takedowns and the arrest in Greece of a principal suspect linked to the malware. VenomRAT remains notable as a widely reused, feature-rich commodity RAT targeting Windows environments across many sectors and geographies.
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
8 distinct threat actors attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.
This comparison explores the core technical differences between VenomRAT and AsyncRAT by analyzing their architecture, capabilities, and tactics.
This comparison explores the core technical differences between VenomRAT and AsyncRAT by analyzing their architecture, capabilities, and tactics.
This comparison explores the core technical differences between VenomRAT and AsyncRAT by analyzing their architecture, capabilities, and tactics.
This comparison explores the core technical differences between VenomRAT and AsyncRAT by analyzing their architecture, capabilities, and tactics.
DCRAT → VenomRAT, EchoRAT, Gh0stRAT, BitRAT, CyberSpike, Dumpling RAT, DarkRAT (via ShaShenRAT)
VenomRAT is a commodity remote access trojan (RAT) used by multiple cybercriminal threat actors. Around since 2020 but first observed in Proofpoint data in 2022... VenomRAT can be used for information gathering, exfiltration, lateral movement, and to download follow-on payloads. Some VenomRAT variants contain ransomware functionality.
33 distinct techniques documented for this family, organized by ATT&CK tactic.
Il est généralement diffusé via des campagnes de phishing, des logiciels piratés, des pièces jointes malveillantes ou encore via l’exploitation des vulnérabilités non corrigées.
Il est généralement diffusé via des campagnes de phishing, des logiciels piratés, des pièces jointes malveillantes ou encore via l’exploitation des vulnérabilités non corrigées.
That subdomain hosts an LNK file, which uses PowerShell to fetch a JavaScript file from the same tunnel.
This batch file is heavily obfuscated and does the real heavy lifting. It opens the fake invoice PDF as a decoy while downloading a second ZIP file that carries a Python package.
When executed, it establishes a connection to an external file share, typically via WebDAV, to download an LNK or VBS file.
When executed, the LNK/VBS executes a BAT or CMD file that downloads a Python installer package and a series of Python scripts leading to malware installation.
The JavaScript, once deobfuscated, quietly pulls down a batch file from the same infrastructure.
This batch file is heavily obfuscated and does the real heavy lifting.
Dynamic API Resolution ✔ DInvokeCore class for dynamic API resolution T1027.007 ✘ Not implemented
Encrypts the configuration ✔ 16-byte salt ("VenomRATByVenom") T1027.013 ✔ 32-byte binary salt T1027.013
It uses this access to allocate memory, create threads, and copy shellcode into place, all classic building blocks of process injection
The technique used here is Early Bird APC Queue injection. It plants code into a newly created process before that process starts running its main thread
Process discovery ✔ This the capability to obtain a listing of running processes T1057 ✘ Not implemented
Keylogging ✔ Advanced keylogger with filtering and process tracking T1056.001 ✔ Basic keylogger with clipboard logging T1056.001
In v1.3, once a client connects to a server, authentication is performed. After that, the main body of data including the commands are exchanged. On the other hand, the authentication is replaced by a TLS handshake in v1.4, and the data exchange begins after that.
134 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.
IPs, domains, and DNS infrastructure linked to this family.
File hashes (MD5, SHA-1, SHA-256) from samples and reports.
68 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Mentioned only as other malware historically using one of the same IP addresses.
VenomRAT2
Remote access trojan delivered as an alternate payload in the same infection chain, injected into notepad.exe by the Python loader.
Fork/descendant in the AsyncRAT family tree, derived through DCRAT lineage.
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.