Venom Stealer Network Connection via Fake Avast Scan

Daniel Jeremiah@daniyyell

•updated Mar 31, 2026•0•33

This rule detects network connections made by a specific executable ('v20svc.exe') to domains ending with 'app-metrics-cdn.com' and containing specific URL paths ('/api/upload', '/api/upload-json', '/api/upload-complete', '/api/listener/heartbeat'). This combination of indicators is associated with the Venom Stealer malware, often delivered via fake Avast scan websites.