VenomRAT is a commodity .NET remote-access trojan sold as malware-as-a-service on underground forums and clearnet sites. It descends from the open-source Quasar and AsyncRAT lineage — sandbox engines routinely tag VenomRAT samples as AsyncRAT — and is widely resold as a kit branded “Venom RAT + HVNC + Stealer + Grabber,” combining remote control, a hidden-desktop (hVNC) module, a credential and browser stealer, and a keylogger. Because it is cheap, cracked and modular, it is used by a broad range of low- to mid-tier actors rather than any single operator.
Overview
VenomRAT was first seen around June 2020 and is frequently conflated with AsyncRAT, Quasar and DcRat because of shared code. It is sold in tiered plans; circulating price figures are inconsistent and are not reproduced here. In 2023 the operator added a dedicated stealer module targeting data from more than 20 browsers.
Capabilities
- Remote control: remote shell, file, task and registry managers, remote desktop and hidden VNC for covert interactive control. T1219
- Theft: a “Recovery” stealer for saved credentials and browser data across 20+ browsers, plus a keylogger. T1555.003 T1056.001
- Tampering: disables Windows Defender and modifies firewall and RDP settings in observed samples. T1562.001 T1562.004
Delivery
- Macro-laden spam dropping a PowerShell follow-on. T1566.001 T1059.001
- Fake software sites: a May 2025 campaign used a fake Bitdefender download site to deliver
StoreInstaller.exe, bundling VenomRAT with the StormKitty stealer and the SilentTrinity post-exploitation framework. T1566.002 - Trojanized GitHub repositories, including a 2023 fake WinRAR proof-of-concept.
ClickFix fake-CAPTCHA chains are a prevalent 2024–2025 delivery vector for AsyncRAT-family RATs generally; a VenomRAT-specific ClickFix campaign is not asserted here without a named source.
MITRE ATT&CK Mapping
Analyst-mapped from reported behaviour.
| Tactic | Technique | Usage |
|---|---|---|
| Command and Control | T1219 Remote Access Software | hVNC and remote control |
| Collection | T1056.001 Keylogging | Keystroke capture |
| Credential Access | T1555.003 Web Browsers | Stealer module |
| Defense Evasion | T1562.001 Disable or Modify Tools | Disables Defender |
| Defense Evasion | T1562.004 Disable System Firewall | Firewall changes |
| Initial Access | T1566.002 Spearphishing Link | Fake download sites |
Detection & Mitigation
- Deploy signatures for the AsyncRAT, Quasar and DcRat family; treat those alerts as potential VenomRAT.
- Block macros from the internet and apply application control to stop installer-style droppers; monitor for Defender and firewall tampering and new hidden-desktop sessions.
- Verify antivirus and software downloads only from canonical vendor domains; inspect egress for AsyncRAT-pattern beacons.
Contain Commodity RAT Infections
Mjolnir Security helps organisations detect commodity RATs and the theft and remote control they enable.
- Managed Detection and Response Monitoring for AsyncRAT-family beacons, hidden-desktop sessions and Defender tampering.
- Threat Hunting as a Service Hunting for macro-droppers and fake-software-download delivery chains.
- 24/7 Incident Response Containment when RAT activity is detected. Call +1 833 403 5875.
Stay ahead of emerging threats. Get notified when we publish new intelligence reports and advisories.
Subscribe to Alerts