← Reports

Remote Access Trojan

VenomRAT - ClientAny.exe

Author
Moise Medici
Updated
15 Nov 2025 · Completed
Difficulty
Easy
Platform
Windows
Capabilities
Persistence MechanismsCommand Execution via Powershell Cmd BashData-Exfiltration
Tags
C#VenomRAT

Admin User Execution

Running the sample as an admin does not make much difference, except that a new scheduled task called dadada appears:

The dadada scheduled task, triggered at log on of any user and starting C:\Users\REM\AppData\Roaming\dadada.exe.
Fig. 5: The dadada scheduled task, triggered at log on of any user and starting C:\Users\REM\AppData\Roaming\dadada.exe.