General
-
Target
eee05be1f50efe61ec62eee4af8bca29e1b37115e0e7d23221bbde4471a6258c
-
Size
534KB
-
Sample
201109-b8th8gzqpa
-
MD5
13efb4a917e73740050da354d95b760b
-
SHA1
e2e0f2b32c1794169a66cee6eda2b36ee4814f9f
-
SHA256
eee05be1f50efe61ec62eee4af8bca29e1b37115e0e7d23221bbde4471a6258c
-
SHA512
c442cf4a4cca8a4c11cf90d0636d9211efd0ee0b69ed85b9fc427671f8e5693e8edff12df3d62c6b24060b6482c41c7c375b671b8111a598917881b09a40afea
Malware Config
Targets
-
-
Target
eee05be1f50efe61ec62eee4af8bca29e1b37115e0e7d23221bbde4471a6258c
-
Size
534KB
-
MD5
13efb4a917e73740050da354d95b760b
-
SHA1
e2e0f2b32c1794169a66cee6eda2b36ee4814f9f
-
SHA256
eee05be1f50efe61ec62eee4af8bca29e1b37115e0e7d23221bbde4471a6258c
-
SHA512
c442cf4a4cca8a4c11cf90d0636d9211efd0ee0b69ed85b9fc427671f8e5693e8edff12df3d62c6b24060b6482c41c7c375b671b8111a598917881b09a40afea
Score10/10-
Contains code to disable Windows Defender
A .NET executable tasked with disabling Windows Defender capabilities such as realtime monitoring, blocking at first seen, etc.
-
Modifies Windows Defender Real-time Protection settings
-
Quasar RAT
Quasar is an open source Remote Access Tool.
-
VenomRAT
VenomRAT is a modified version of QuasarRAT with some added features, such as rootkit and stealer capabilites.
-
Executes dropped EXE
-
Loads dropped DLL
-
Windows security modification
-
Looks up external IP address via web service
Uses a legitimate IP lookup service to find the infected system's external IP.
-