Trojan:MSIL/VenomRAT.A!MTB

Trojan:MSIL/VenomRAT.A!MTB is an advanced backdoor, developed within the .NET ecosystem as indicated by its use of Microsoft Intermediate Language (MSIL). Because of its design, the malware needs the .NET runtime to run, but the intermediate language format can also confound security tools that only do basic analysis of MSIL, providing an initial layer of obfuscation. 

When it runs, it will be able to do a wide range of malicious actions, ranging from searching and exfiltrating sensitive files, to actively collecting credentials from multiple installed web browsers, as well as targeting specific cryptocurrency wallets to exfiltrate any sensitive data. A primary behavioral attribute while it is running is creating processes that show up as blank or are listed with no name in the Windows Task Manager, to obscure activities from observers. 

Communication with its operators is maintained through connections to hardcoded Command and Control (C2) servers. Documented infrastructure includes the IP addresses 67[.]217.228[.]160 on port 4449, 172[.]93.222[.]102 on port 4449, 15[.]228.248[.]225 on port 5552, and 94.141.123[.]234 on port 4449. A primary sample involved in distribution campaigns has been identified as StoreInstaller.exe with the SHA256 hash e33b8b32bccfb50f604f06a306d1af89ae7b0d583bca20c41fa5811f526aa420, often delivered through spoofed websites such as bitdefender-download[.]com or other malicious links. 

To ensure it remains active after a system reboot, the RAT employs persistence mechanisms by creating or modifying Windows Registry keys. It typically targets autostart locations like HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run and HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run. It may also attempt to deactivate security features by altering keys such as HKCU\Software\Microsoft\Windows Script\Settings\AmsiEnable to thwart script scanning or manipulate Windows Update settings via SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU\NoAutoUpdate. VenomRAT is deployed in coordinated campaigns alongside other threats, creating a complex, multi-faceted infection on target devices. 

It communicates to the following hosts: 

• 67[.]217.228[.]160 on port 4449 
• 172[.]93.222[.]102 on port 4449 
• 15[.]228.248[.]225 on port 5552 
• 94.141.123[.]234 on port 4449 

Accesses or downloads from following URLs: 

• bitdefender-download[.]com 

VenomRAT sets the following registry entries: 

• HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run and HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run 
• HKCU\Software\Microsoft\Windows Script\Settings\AmsiEnable 
• HKLM\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU\NoAutoUpdate