Loading malware…
VenomRAT is a commodity Windows remote access trojan (RAT) active since at least 2020 and observed by Proofpoint since 2022. The content describes it as based on Quasar RAT and also places it in the broader AsyncRAT/DcRat lineage, with Censys mapping AsyncRAT → DcRat → VenomRAT and ESET assessing VenomRAT was likely inspired by DcRat. It is used by multiple cybercriminal threat actors and has been distributed through phishing campaigns, malicious websites, and multi-stage loader chains. Reported delivery methods include email lures leading to JavaScript files that spawn PowerShell to download and execute the malware, tax- and invoice-themed phishing, abuse of Dropbox and Cloudflare TryCloudflare tunnels, and trojanized software installers such as Internet Download Manager packages delivered via ISO/EXE files.
Capabilities directly mentioned in the content include information gathering, credential theft, exfiltration, lateral movement, download and execution of follow-on payloads, keylogging, screenshot capture, webcam capture, hidden VNC-style remote control via the broader Venom suite, clipboard hijacking, and long-term persistence. Some variants contain ransomware functionality. VenomRAT has been observed injected into legitimate processes such as notepad.exe, and in broader campaigns related loaders used shellcode injection and Early Bird APC queue injection into Windows processes. It has also appeared alongside or on shared infrastructure with other malware families including AsyncRAT, XWorm, DcRat, Remcos, Vidar, StormKitty, LummaStealer, RedLine, Rhadamanthys, and Elysium.
Associated activity and operators mentioned in the content include TA558, identified by Proofpoint as the most prominent VenomRAT distributor and accounting for 58% of VenomRAT observed in its email campaign data since 2022, and TA2541, which also used the malware in some campaigns. TA558 primarily targeted Portuguese and Spanish speakers, typically in Latin America, but also targeted Western Europe and North America. VenomRAT was also part of the Venom malware suite marketed through the Venom Software site, which advertised stealer, VenomRAT, Venom hVNC, and related capabilities. French authorities later indicted a suspect believed to be the developer of the Venom suite.
The malware’s infrastructure has been the subject of law-enforcement disruption under Operation Endgame. Content states that on 13 November 2025 authorities disrupted VenomRAT infrastructure, took down the advertising/distribution domain remotesystem[.]in and licensing domain venomlicense[.]com, and arrested the suspected creator in Greece. Operation Endgame reporting also states that more than 1,000 servers tied to Rhadamanthys, VenomRAT, and Elysium were taken down. Additional infrastructure references in the content include Censys-confirmed VenomRAT command-and-control hosts, with about 18 hosts tracked as of 16 June 2026, and multi-family C2 infrastructure such as 178.22.24.175, which was linked to VenomRAT, Vidar, StormKitty, QuasarRAT/AsyncRAT, and RedLine. Other cited VenomRAT-related infrastructure includes 62.60.190.141 over ports 3232 and 4056, 62.60.190.196, and observations of VenomRAT on 178.16.55[.]129 within a Seychelles-hosted subnet.
High-confidence indicators explicitly mentioned in the content include the domains remotesystem[.]in and venomlicense[.]com; IPs 178.22.24.175, 62.60.190.141, 62.60.190.196, and 178.16.55[.]129; and a family-wide TLS certificate hunting pattern inherited from the AsyncRAT/DcRat ecosystem: self-signed certificates on non-standard ports with Subject/Issuer metadata matching "O=<Name> By <author>, L=SH, C=CN."
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
4 distinct threat actors attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.
DCRAT → VenomRAT, EchoRAT, Gh0stRAT, BitRAT, CyberSpike, Dumpling RAT, DarkRAT (via ShaShenRAT)
VenomRAT is a commodity remote access trojan (RAT) used by multiple cybercriminal threat actors. Around since 2020 but first observed in Proofpoint data in 2022... VenomRAT can be used for information gathering, exfiltration, lateral movement, and to download follow-on payloads. Some VenomRAT variants contain ransomware functionality.
VenomRAT is a commodity remote access trojan (RAT) used by multiple cybercriminal threat actors. Around since 2020 but first observed in Proofpoint data in 2022... VenomRAT can be used for information gathering, exfiltration, lateral movement, and to download follow-on payloads. Some VenomRAT variants contain ransomware functionality.
The toolkit includes PureLogs, PureHVNC, and repackaged commodity RATs (AsyncRAT, VenomRAT, DcRat, XWorm).
31 distinct techniques documented for this family, organized by ATT&CK tactic.
T1583.003 — Acquire Infrastructure: Virtual Private Server (Resource Development)
« VenomRAT ». Ce programme malveillant identifié en 2020 était principalement « diffusé via des campagnes d'hameçonnage ou de sites Internet malveillants »
Proofpoint frequently observes VenomRAT in email campaign data... TA558 VenomRAT campaigns typically include 1,000 messages or less with lures in Portuguese, Spanish, and occasionally English.
That subdomain hosts an LNK file, which uses PowerShell to fetch a JavaScript file from the same tunnel.
This batch file is heavily obfuscated and does the real heavy lifting. It opens the fake invoice PDF as a decoy while downloading a second ZIP file that carries a Python package.
When executed, it establishes a connection to an external file share, typically via WebDAV, to download an LNK or VBS file.
When executed, the LNK/VBS executes a BAT or CMD file that downloads a Python installer package and a series of Python scripts leading to malware installation.
The JavaScript, once deobfuscated, quietly pulls down a batch file from the same infrastructure.
allocate RWX memory, write shellcode via WriteProcessMemory ... ctypes.windll.kernel32.VirtualProtect(... 0x40, # PAGE_EXECUTE_READWRITE ... )
This batch file is heavily obfuscated and does the real heavy lifting.
Defense Evasion Obfuscated Files: Encrypted Payload T1027.013 1–6 Multi-layer encryption (XOR, AES, Donut/Chaskey)
It uses this access to allocate memory, create threads, and copy shellcode into place, all classic building blocks of process injection
The technique used here is Early Bird APC Queue injection. It plants code into a newly created process before that process starts running its main thread
[Stage 3: Batch Downloader] - Deletes .bat files post-execution (anti-forensics)
Clicking it downloads a ZIP file containing an internet shortcut, and opening it connects to a TryCloudflare subdomain.
If detected, downloads abb11.zip (OBKS-only, Avast-safe profile). If not, downloads quz11.zip (full WBKS + BKSNO deployment).
Checks for AvastUI.exe and AVGUI.exe via tasklist. If detected, downloads abb11.zip (OBKS-only, Avast-safe profile). If not, downloads quz11.zip
57 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.
IPs, domains, and DNS infrastructure linked to this family.
File hashes (MD5, SHA-1, SHA-256) from samples and reports.
60 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
VenomRAT2
Remote access trojan delivered as an alternate payload in the same infection chain, injected into notepad.exe by the Python loader.
Fork/descendant in the AsyncRAT family tree, derived through DCRAT lineage.
The disruption is the latest phase of Operation Endgame, which previously disrupted other malware families, such as DanaBot, Bumblebee, Rhadamanthys, VenomRAT, Elysium, and SmokeLoader.
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.