Overview

overview

10

Static

static

08028.jar

windows7_x64

10

08028.jar

windows10_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    08028.jar

  • Size

    403KB

  • Sample

    200830-yxkv6l4fln

  • MD5

    805fada47d34674fac492573b6f01de8

  • SHA1

    a796de518f1c7582485d80d5e3d1904a20e79a22

  • SHA256

    fbfd10ddb1840f5f1deedc2067baca46c28a06078d9abea612a7948c75fcd352

  • SHA512

    f3f5d5bf9aa312a527c770f37d97f09ee8322293db00a302bb56cce5e407df2d94ec19ffb87d176e5867870b882b93c57f8b64b67deda1586a8ac3dc4d012a99

Score
10/10
qarallaxevasionpersistencetrojan

Malware Config

Targets

    • Target

      08028.jar

    • Size

      403KB

    • MD5

      805fada47d34674fac492573b6f01de8

    • SHA1

      a796de518f1c7582485d80d5e3d1904a20e79a22

    • SHA256

      fbfd10ddb1840f5f1deedc2067baca46c28a06078d9abea612a7948c75fcd352

    • SHA512

      f3f5d5bf9aa312a527c770f37d97f09ee8322293db00a302bb56cce5e407df2d94ec19ffb87d176e5867870b882b93c57f8b64b67deda1586a8ac3dc4d012a99

    Score
    10/10
    persistenceevasiontrojanqarallax

    • Modifies Windows Defender Real-time Protection settings

      evasiontrojan

    • QarallaxRAT

      Qarallax is a RAT developed by Quaverse and sold as RaaS (RAT as a Service).

      trojanqarallax

    • Qarallax RAT support DLL

    • Disables Task Manager via registry modification

      evasion

    • Disables use of System Restore points

      evasion

    • Sets file execution options in registry

      persistence

    • Loads dropped DLL

    • Adds Run key to start application

      persistence

    • Drops desktop.ini file(s)

    • Drops file in System32 directory

    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks