General
-
Target
a4f428c28ca8bc75760bc1dbb3f4f292910e164c9f75e25c243f451dfb54bad1
-
Size
534KB
-
Sample
210228-7hwyw1k6ya
-
MD5
4073146dfe350cbc3ca325a61c97ba2e
-
SHA1
d5c51cd4c29165914760bc6edb9a3fbaa6c98798
-
SHA256
a4f428c28ca8bc75760bc1dbb3f4f292910e164c9f75e25c243f451dfb54bad1
-
SHA512
6c3828e241a99a93dc0c3ece82f0204582f18d852912d08dbb6f0e6558edcdefc8de7f6f7e98630088a270498a50474a45b52c49400102036a4b07f879fcc09f
Malware Config
Targets
-
-
Target
a4f428c28ca8bc75760bc1dbb3f4f292910e164c9f75e25c243f451dfb54bad1
-
Size
534KB
-
MD5
4073146dfe350cbc3ca325a61c97ba2e
-
SHA1
d5c51cd4c29165914760bc6edb9a3fbaa6c98798
-
SHA256
a4f428c28ca8bc75760bc1dbb3f4f292910e164c9f75e25c243f451dfb54bad1
-
SHA512
6c3828e241a99a93dc0c3ece82f0204582f18d852912d08dbb6f0e6558edcdefc8de7f6f7e98630088a270498a50474a45b52c49400102036a4b07f879fcc09f
Score10/10-
Contains code to disable Windows Defender
A .NET executable tasked with disabling Windows Defender capabilities such as realtime monitoring, blocking at first seen, etc.
-
Modifies Windows Defender Real-time Protection settings
-
Quasar RAT
Quasar is an open source Remote Access Tool.
-
VenomRAT
VenomRAT is a modified version of QuasarRAT with some added features, such as rootkit and stealer capabilites.
-
Executes dropped EXE
-
Loads dropped DLL
-
Windows security modification
-
Looks up external IP address via web service
Uses a legitimate IP lookup service to find the infected system's external IP.
-