Overview

overview

10

Static

static

PO20200623.jar

windows7_x64

10

PO20200623.jar

windows10_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    PO20200623.jar

  • Size

    406KB

  • Sample

    200626-fqm9d188dj

  • MD5

    849ac004f76921b87bf21035f6b5e14b

  • SHA1

    af1c66fde1026618b9db019a979e082d22b69b2d

  • SHA256

    2b9e74db724cd836104a57ae1b4eff596ea093d65153734e3b7167e6923db3fd

  • SHA512

    fbbb369c9140d8383d604beeffb23111242d9608b77f9a2686462d7d693b96b157ad1167faa8d7e16000d546fe3b9cd6f31a02edba5acf2c1465762110660f3e

Score
10/10
qarallaxevasionpersistencetrojan

Malware Config

Targets

    • Target

      PO20200623.jar

    • Size

      406KB

    • MD5

      849ac004f76921b87bf21035f6b5e14b

    • SHA1

      af1c66fde1026618b9db019a979e082d22b69b2d

    • SHA256

      2b9e74db724cd836104a57ae1b4eff596ea093d65153734e3b7167e6923db3fd

    • SHA512

      fbbb369c9140d8383d604beeffb23111242d9608b77f9a2686462d7d693b96b157ad1167faa8d7e16000d546fe3b9cd6f31a02edba5acf2c1465762110660f3e

    Score
    10/10
    qarallaxevasionpersistencetrojan

    • Modifies Windows Defender Real-time Protection settings

      evasiontrojan

    • QarallaxRAT

      Qarallax is a RAT developed by Quaverse and sold as RaaS (RAT as a Service).

      trojanqarallax

    • Qarallax RAT support DLL

    • Disables Task Manager via registry modification

      evasion

    • Disables use of System Restore points

      evasion

    • Sets file execution options in registry

      persistence

    • Loads dropped DLL

    • Adds Run key to start application

      persistence

    • Drops desktop.ini file(s)

    • Drops file in System32 directory

    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks