Overview

overview

10

Static

static

cela.exe

windows7_x64

10

cela.exe

windows10_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    cela.exe

  • Size

    930KB

  • Sample

    201213-rthgjqvmjj

  • MD5

    507c92e12c99eb53544aba006004b843

  • SHA1

    11205b1e7e9317192994f5a9037d0f9924f29469

  • SHA256

    3f50cb0f25bc9fdaa5c75865eaca04ed12f45d5419b6624f1cf0f507be3cdafe

  • SHA512

    21b13fa6b070f3fecab15fe8c4124c4ec592b2886eff6a9b39efef84097aa33defc0815a1696617674072343144c83f6756f349e2b71afef11e69f46f614bc16

Score
10/10
quasarvenomratevasionratrootkitspywarestealertrojan

Malware Config

Targets

    • Target

      cela.exe

    • Size

      930KB

    • MD5

      507c92e12c99eb53544aba006004b843

    • SHA1

      11205b1e7e9317192994f5a9037d0f9924f29469

    • SHA256

      3f50cb0f25bc9fdaa5c75865eaca04ed12f45d5419b6624f1cf0f507be3cdafe

    • SHA512

      21b13fa6b070f3fecab15fe8c4124c4ec592b2886eff6a9b39efef84097aa33defc0815a1696617674072343144c83f6756f349e2b71afef11e69f46f614bc16

    Score
    10/10
    quasarvenomratevasionratrootkitspywarestealertrojan

    • Modifies Windows Defender Real-time Protection settings

      evasiontrojan

    • Quasar RAT

      Quasar is an open source Remote Access Tool.

      trojanspywarequasar

    • VenomRAT

      VenomRAT is a modified version of QuasarRAT with some added features, such as rootkit and stealer capabilites.

      ratrootkitstealervenomrat

    • Executes dropped EXE

    • Loads dropped DLL

    • Windows security modification

      evasiontrojan

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks