General
-
Target
b603bb5bf05a55c7687cbfa64566cb5608947284b8eaf0da2b1b6d282fee3ecd
-
Size
695KB
-
Sample
210228-wq1rjc8g1a
-
MD5
75a0dff08308ea7de7a5a7a0528683de
-
SHA1
79fbffc4c4b90d58ea179ece6153302e8dd4012d
-
SHA256
b603bb5bf05a55c7687cbfa64566cb5608947284b8eaf0da2b1b6d282fee3ecd
-
SHA512
2cd661e50aad22c1d2b113dbe0e92f5391bc370fc19b8adf2009431a2dfd48072bf15a65edf6089c562ffeabee4c8fc0ab556448cef7a0ea72b007bd0df9708c
Malware Config
Targets
-
-
Target
b603bb5bf05a55c7687cbfa64566cb5608947284b8eaf0da2b1b6d282fee3ecd
-
Size
695KB
-
MD5
75a0dff08308ea7de7a5a7a0528683de
-
SHA1
79fbffc4c4b90d58ea179ece6153302e8dd4012d
-
SHA256
b603bb5bf05a55c7687cbfa64566cb5608947284b8eaf0da2b1b6d282fee3ecd
-
SHA512
2cd661e50aad22c1d2b113dbe0e92f5391bc370fc19b8adf2009431a2dfd48072bf15a65edf6089c562ffeabee4c8fc0ab556448cef7a0ea72b007bd0df9708c
Score10/10-
Contains code to disable Windows Defender
A .NET executable tasked with disabling Windows Defender capabilities such as realtime monitoring, blocking at first seen, etc.
-
Modifies visiblity of hidden/system files in Explorer
-
VenomRAT
VenomRAT is a modified version of QuasarRAT with some added features, such as rootkit and stealer capabilites.
-
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
-
Executes dropped EXE
-
Loads dropped DLL
-
Adds Run key to start application
-
Looks up external IP address via web service
Uses a legitimate IP lookup service to find the infected system's external IP.
-
Drops file in System32 directory
-