{"id":2697,"date":"2025-03-19T10:03:34","date_gmt":"2025-03-19T10:03:34","guid":{"rendered":"https:\/\/serisec.com\/index.php\/2025\/03\/19\/hacker-weaponizing-hard-disk-image-files-to-deliver-venomrat\/"},"modified":"2025-03-19T10:03:34","modified_gmt":"2025-03-19T10:03:34","slug":"hacker-weaponizing-hard-disk-image-files-to-deliver-venomrat","status":"publish","type":"post","link":"https:\/\/serisec.com\/index.php\/2025\/03\/19\/hacker-weaponizing-hard-disk-image-files-to-deliver-venomrat\/","title":{"rendered":"Hacker Weaponizing Hard Disk Image Files To Deliver VenomRAT"},"content":{"rendered":"

Hacker Weaponizing Hard Disk Image Files To Deliver VenomRAT
\n \t

\n
<\/BR>
\n
\n \t

\n
<\/BR><\/p>\n

\n

A sophisticated phishing campaign is leveraging virtual hard disk (.vhd) files to distribute the dangerous VenomRAT malware.<\/p>\n

The attack begins with purchase order-themed emails containing archive attachments that, when extracted, reveal hard disk image files designed to evade traditional security measures<\/a>.<\/p>\n

\n
\"\"
Batch file inside .vhd file (Source \u2013 Forcepoint)<\/figcaption><\/figure>\n<\/div>\n

Upon opening, the .vhd file mounts itself as a disk drive containing a heavily obfuscated batch script that performs malicious activities using PowerShell.<\/p>\n

The batch file contains multiple layers of obfuscation<\/a> including garbage characters, Base64 encoding, and AES encryption.<\/p>\n

Forcepoint researchers identified<\/a> that once executed, the malware creates a copy of itself in \u201cC:Users%userprofile%dwm.bat\u201d and opens PowerShell to execute additional commands.<\/p>\n

The script then modifies registry entries to ensure persistence on the infected system.<\/p>\n

The attack chain continues as the malware drops additional files into the StartUp folder and connects to Pastebin.com where command and control server information is stored.<\/p>\n

These techniques help the malware establish a foothold and maintain communication with its operators.<\/p>\n

Analysis VenomRAT<\/strong><\/h2>\n

Analysis of the payload reveals it is VenomRAT version 6.0.3, which includes HVNC (Hidden Virtual Network Computing) service capabilities for remote system control.<\/p>\n

\n
\"\"
DataLogs.conf in AppData \u2013 Roaming (Source \u2013 Forcepoint)<\/figcaption><\/figure>\n<\/div>\n

The malware drops a DataLogs.conf file in \u201cC:Users%userprofile%AppDataRoamingMyData\u201d to capture keystrokes and other sensitive information<\/a>.<\/p>\n

\n
\"\"
Config file used by VenomRAT (Source \u2013 Forcepoint)<\/figcaption><\/figure>\n<\/div>\n

This configuration file contains an AES encryption key \u201ca487de3093a5DGe47d49bc0733cbcleMec5Ed75adee513c39017e977a04597dr\u201d with a salt value of \u201cVenombatzyVeacon\u201d, which the malware uses for secure communication with its command servers.<\/p>\n

Investigate Real-World Malicious Links & Phishing Attacks With\u00a0Threat Intelligence Lookup<\/strong>\u00a0-\u00a0Try for Free<\/a><\/code><\/strong><\/code><\/strong><\/strong><\/code><\/strong><\/strong><\/p>\n

The post Hacker Weaponizing Hard Disk Image Files To Deliver VenomRAT<\/a> appeared first on Cyber Security News<\/a>.<\/p>\n<\/div>\n

\t

\n
<\/BR>
\n Tushar Subhra Dutta
\n \t

\n
<\/BR>
\nGo to cyber-security-news<\/a>
\n \t

\n
<\/BR><\/p>\n","protected":false},"excerpt":{"rendered":"

Hacker Weaponizing Hard Disk Image Files To Deliver VenomRAT A sophisticated phishing campaign is leveraging virtual hard disk (.vhd) files to distribute the dangerous VenomRAT malware. The attack begins with purchase order-themed emails containing archive attachments that, when extracted, reveal hard disk image files designed to evade traditional security measures. Batch file inside .vhd file […]<\/p>\n","protected":false},"author":2,"featured_media":0,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[129,63,649],"tags":[130],"class_list":["post-2697","post","type-post","status-publish","format-standard","hentry","category-cyber-security","category-cyber-security-news","category-threats","tag-cyber-security-news"],"_links":{"self":[{"href":"https:\/\/serisec.com\/index.php\/wp-json\/wp\/v2\/posts\/2697"}],"collection":[{"href":"https:\/\/serisec.com\/index.php\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/serisec.com\/index.php\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/serisec.com\/index.php\/wp-json\/wp\/v2\/users\/2"}],"replies":[{"embeddable":true,"href":"https:\/\/serisec.com\/index.php\/wp-json\/wp\/v2\/comments?post=2697"}],"version-history":[{"count":0,"href":"https:\/\/serisec.com\/index.php\/wp-json\/wp\/v2\/posts\/2697\/revisions"}],"wp:attachment":[{"href":"https:\/\/serisec.com\/index.php\/wp-json\/wp\/v2\/media?parent=2697"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/serisec.com\/index.php\/wp-json\/wp\/v2\/categories?post=2697"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/serisec.com\/index.php\/wp-json\/wp\/v2\/tags?post=2697"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}