Modifies Windows Registry keys (e.g., HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run ) to ensure the malware restarts upon reboot.
Do not execute this file on a host machine. If you are using it for educational purposes, ensure you are in a completely isolated, air-gapped virtual machine .
Includes basic obfuscation and "anti-VM" checks to prevent analysis in sandboxed environments like Any.Run .
Block traffic to common C2 ports associated with Venom, often ranging from 4444 to 5555, unless specifically configured otherwise.
Capabilities for building malicious executables (.exe) or DLLs that can be deployed on target machines.