Overview

overview

10

Static

static

10

9d6bec6cd6...e9.exe

windows7_x64

10

9d6bec6cd6...e9.exe

windows10_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    9d6bec6cd6036c30bd8ea5f57658f81b98a843d786ded9546a51d44341da17e9

  • Size

    534KB

  • Sample

    201114-wtv1lefhd6

  • MD5

    e89e338133db30b5f37a44bcf4cb7e60

  • SHA1

    2babb532d70454d59c51be0d25630a6bb8f86f0d

  • SHA256

    9d6bec6cd6036c30bd8ea5f57658f81b98a843d786ded9546a51d44341da17e9

  • SHA512

    ffa6030711d5f6e989a234398298148753219e4da64e8cd2315da3ef16d9162cabb42b2d8223e311c5d4eff43ce6c20f74c686a765544756b980f91942efee0e

Score
10/10
quasarvenomratevasionratrootkitspywarestealertrojan

Malware Config

Targets

    • Target

      9d6bec6cd6036c30bd8ea5f57658f81b98a843d786ded9546a51d44341da17e9

    • Size

      534KB

    • MD5

      e89e338133db30b5f37a44bcf4cb7e60

    • SHA1

      2babb532d70454d59c51be0d25630a6bb8f86f0d

    • SHA256

      9d6bec6cd6036c30bd8ea5f57658f81b98a843d786ded9546a51d44341da17e9

    • SHA512

      ffa6030711d5f6e989a234398298148753219e4da64e8cd2315da3ef16d9162cabb42b2d8223e311c5d4eff43ce6c20f74c686a765544756b980f91942efee0e

    Score
    10/10
    quasarvenomratevasionratrootkitspywarestealertrojan

    • Contains code to disable Windows Defender

      A .NET executable tasked with disabling Windows Defender capabilities such as realtime monitoring, blocking at first seen, etc.

    • Modifies Windows Defender Real-time Protection settings

      evasiontrojan

    • Quasar RAT

      Quasar is an open source Remote Access Tool.

      trojanspywarequasar

    • VenomRAT

      VenomRAT is a modified version of QuasarRAT with some added features, such as rootkit and stealer capabilites.

      ratrootkitstealervenomrat

    • Executes dropped EXE

    • Loads dropped DLL

    • Windows security modification

      evasiontrojan

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks