Overview

overview

10

Static

static

10

8920c6867d...00.exe

windows7_x64

10

8920c6867d...00.exe

windows10_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    8920c6867df1eeaec33e3e6253524700

  • Size

    534KB

  • Sample

    201025-h2yr68pw5j

  • MD5

    8920c6867df1eeaec33e3e6253524700

  • SHA1

    4ce786281b76b6949166092faa9bfccee4e2c599

  • SHA256

    b126d2bf73da9bce2f1a0748febb99510127eee852284a75c777ebac33b39649

  • SHA512

    fec621690ca21fc62a46c6b285a0bad0d6f3e4c792997616216b227b5a01db78b1b769c4847f3b6d0bc70d95f12b73885156b3164f319cda5d44b34861ef12e2

Score
10/10
quasarvenomratevasionratrootkitspywarestealertrojan

Malware Config

Targets

    • Target

      8920c6867df1eeaec33e3e6253524700

    • Size

      534KB

    • MD5

      8920c6867df1eeaec33e3e6253524700

    • SHA1

      4ce786281b76b6949166092faa9bfccee4e2c599

    • SHA256

      b126d2bf73da9bce2f1a0748febb99510127eee852284a75c777ebac33b39649

    • SHA512

      fec621690ca21fc62a46c6b285a0bad0d6f3e4c792997616216b227b5a01db78b1b769c4847f3b6d0bc70d95f12b73885156b3164f319cda5d44b34861ef12e2

    Score
    10/10
    ratrootkitstealervenomratevasiontrojanspywarequasar

    • Contains code to disable Windows Defender

      A .NET executable tasked with disabling Windows Defender capabilities such as realtime monitoring, blocking at first seen, etc.

    • Modifies Windows Defender Real-time Protection settings

      evasiontrojan

    • Quasar RAT

      Quasar is an open source Remote Access Tool.

      trojanspywarequasar

    • VenomRAT

      VenomRAT is a modified version of QuasarRAT with some added features, such as rootkit and stealer capabilites.

      ratrootkitstealervenomrat

    • Executes dropped EXE

    • Loads dropped DLL

    • Windows security modification

      evasiontrojan

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks