Overview

overview

10

Static

static

STATEMENT.jar

windows7_x64

10

STATEMENT.jar

windows10_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    STATEMENT.jar

  • Size

    410KB

  • Sample

    200806-k3ev8mxahj

  • MD5

    c97cbc1f72a7a3100781e9e9dd0726c9

  • SHA1

    cfd2845d70ba1de8fa041c844deacf5f72d360b2

  • SHA256

    af2282169fd256121196373e4a1171e44ab0dd830ffd5f2b49f5b5d0a9f6b473

  • SHA512

    0592feef2b9dfeeb87fd8dec6682664dbacfd4ec70e7e52d0dd08b39ba3590af4662c0cc5236bbd334e5b06c8a1207d06341b104000d889ebb6454ac2d18f9ba

Score
10/10
qarallaxevasionpersistencetrojan

Malware Config

Targets

    • Target

      STATEMENT.jar

    • Size

      410KB

    • MD5

      c97cbc1f72a7a3100781e9e9dd0726c9

    • SHA1

      cfd2845d70ba1de8fa041c844deacf5f72d360b2

    • SHA256

      af2282169fd256121196373e4a1171e44ab0dd830ffd5f2b49f5b5d0a9f6b473

    • SHA512

      0592feef2b9dfeeb87fd8dec6682664dbacfd4ec70e7e52d0dd08b39ba3590af4662c0cc5236bbd334e5b06c8a1207d06341b104000d889ebb6454ac2d18f9ba

    Score
    10/10
    persistenceevasiontrojanqarallax

    • Modifies Windows Defender Real-time Protection settings

      evasiontrojan

    • QarallaxRAT

      Qarallax is a RAT developed by Quaverse and sold as RaaS (RAT as a Service).

      trojanqarallax

    • Qarallax RAT support DLL

    • Disables Task Manager via registry modification

      evasion

    • Disables use of System Restore points

      evasion

    • Sets file execution options in registry

      persistence

    • Loads dropped DLL

    • Adds Run key to start application

      persistence

    • Drops desktop.ini file(s)

    • Drops file in System32 directory

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Modify Existing Service

1
T1031

Registry Run Keys / Startup Folder

2
T1060

Hidden Files and Directories

1
T1158

Privilege Escalation

Defense Evasion

Modify Registry

3
T1112

Disabling Security Tools

1
T1089

Hidden Files and Directories

1
T1158

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Inhibit System Recovery

1
T1490

Tasks