Analysis Identifies VioletRAT Variant in Campaign Targeting Italy
Summary
Researchers attribute a memory-carved .NET sample to VioletRAT, documenting Pastebin-based configuration, encrypted TCP C2, remote-control and credential-theft capabilities. Conflicting version markers leave the specific build uncertain.
Key points
- Memory carving of an explorer.exe dump recovered one valid .NET assembly from 17 candidates; researchers decompiled it with ILSpy.
- The sample contains “Violet v4.7” and “VIOLET V5 64” markers, supporting VioletRAT-family attribution but leaving the specific build uncertain.
- The code retrieves initial configuration from Pastebin, then uses an encrypted TCP C2 connection with Rijndael/ECB and an MD5-derived key; the sample contains the password Nuevo2022$.
- Analyzed capabilities include remote shell commands, file download and execution, process manipulation, and remote desktop screenshots.
- The sample contains credential- and data-collection modules, including password recovery, database collection, and token-related functions.
- Code features include registry writes, UAC elevation attempts, Windows Defender disabling, and in-memory payload handling; the article reports no static C2 IP addresses or file hashes.
Article Details
- Attack Vectors
- The campaign targeted users in Italy; the article does not specify the initial delivery method.
- The malware retrieves its initial configuration from a Pastebin URL embedded in the code, then extracts an IP address and port for C2 communication.
- VioletRAT uses an encrypted TCP session for C2 and supports remote shell commands, file download and execution, and data collection.
- Defensive Notes
- The sample reportedly attempts UAC elevation and disables Windows Defender; the article provides no specific defensive guidance.
MITRE ATT&CK
T1041 · Exfiltration Over C2 ChannelThe article reports that the malware sends harvested credentials and other data to its C2 infrastructure.T1055 · Process InjectionThe article describes the injRun plugin as supporting execution or injection; it does not specify a target process.T1056.001 · KeyloggingThe article reports keylogging and collection of typed information.T1057 · Process DiscoveryThe R# command enumerates processes, including their PIDs and paths.T1059.003 · Windows Command ShellThe malware starts CMD.EXE with redirected input and output for interactive remote shell execution.T1102 · Web ServiceThe sample retrieves its initial configuration from a Pastebin URL embedded in the code.T1105 · Ingress Tool TransferThe LN command downloads a remote file and starts it using DownloadFile and Process.Start.T1113 · Screen CaptureThe RD+ command captures desktop frames as JPEG images and sends them to the C2.T1115 · Clipboard DataThe malware includes a Clipper module for clipboard hijacking.T1548.002 · Bypass User Account ControlThe article reports UAC elevation and bypass attempts.T1555.003 · Credentials from Web BrowsersThe malware includes modules for collecting browser passwords.T1562.001 · Disable or Modify ToolsThe sample reportedly disables Windows Defender.
Malware
Products
Tools
ILSpyMemory carving from an explorer.exe dump recovered a .NET assembly (dotnet_0000_off_50e208.bin) which decompiled successfully with ILSpy and revealed RAT functionality.ilspycmdI file estratti tramite memory carving sono stati successivamente analizzati utilizzando ILSpy tramite l’interfaccia a riga di comando (ilspycmd).