Loading malware…
Venom RAT is a Windows remote access trojan in the QuasarRAT/AsyncRAT ecosystem that is marketed in cybercrime communities as a multi-function malware tool. It is widely described as a successor to Quasar RAT and has been observed both as a standalone commodity RAT and as a payload delivered by intermediary loaders. Core capabilities attributed to Venom RAT include remote command execution, file management, surveillance, keylogging, credential theft, data exfiltration, and covert remote control of infected systems. Some variants or premium builds advertise hidden virtual network computing functionality, enabling attackers to interact with compromised hosts through invisible desktop sessions for stealthier post-compromise activity. Additional reported features include reverse-proxy behavior, anti-kill or anti-analysis protections, removable-media propagation, and persistence mechanisms on Windows hosts.
Venom RAT has been delivered through multiple intrusion vectors. Documented distribution methods include phishing campaigns using invoice and reservation-themed lures, JavaScript and PowerShell-based download chains, malicious shortcut files, trojanized or cracked software, fake update lures, and ClickFix-style social engineering chains in which a separate loader ultimately deploys the RAT. It has also been associated with broader commodity-malware ecosystems and malware-as-a-service style offerings, including cracked releases and bundled hidden-access modules.
The malware has appeared in campaigns linked to several threat clusters and criminal operations. It has been used in hotel-focused campaigns attributed to TA558/RevengeHotels targeting Brazil and other Spanish-speaking markets, with the objective of stealing payment-card and travel-related data. CERT-UA has also listed Venom RAT among the commodity malware families used in campaigns affecting Ukrainian organizations. Law-enforcement action under Operation Endgame targeted infrastructure associated with Venom RAT in late 2025, reflecting its role in large-scale cybercrime operations.
Venom RAT primarily targets Windows systems and is used for unauthorized remote administration, credential theft, surveillance, and follow-on intrusion activity. Its combination of commodity availability, modular functionality, and stealth-oriented features has made it a recurring tool in financially motivated phishing and access operations.
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
2 distinct threat actors attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.
...застосовано... шкідливих програм: REMCOS RAT, QUASAR RAT, VENOM RAT, REMOTE UTILITIES та LUMMASTEALER.
8 distinct techniques documented for this family, organized by ATT&CK tactic.
"...для проникнення до мережі зловмисники використовували скомпрометовані облікові записи VPN..."
Across these threads, the same pattern continued: promotion of RATs, crypters, and related tooling... On DarkForums itself, the same user was found promoting a range of tools, including... APK encryption and bypass methods... This thread, posted by “markoliver,” promoted an APK encryption method...
Le logiciel malveillant est principalement distribué par le biais de courriels de spear-phishing contenant des pièces jointes ou des liens malveillants, souvent en usurpant l'identité d'entités légitimes.
hVNC utilizes the Microsoft Windows Desktop API to craft a hidden desktop via the Windows feature CreateDesktop. This concealed desktop remains invisible to users... hVNC capabilities go beyond mere observation, actively emulating keyboard and mouse input, allowing cybercriminals to navigate compromised systems with precision.
195 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.
IPs, domains, and DNS infrastructure linked to this family.
File hashes (MD5, SHA-1, SHA-256) from samples and reports.
15 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
AsyncRAT Family Threat Overview AsyncRAT BitRAT DCRat Quasar RAT Venom RAT
Remote access trojan promoted in a Pro HVNC RAT variant.
A remote access trojan observed on the same /24 subnet among other criminal tooling.
Remote access trojan delivered as the final payload by Kiss Loader; described as an AsyncRAT variant and executed via APC injection.
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.