General
-
Target
fbebdf6e8fa43a2458cd66a14dfa5b7127727c55b93a67f40f400e8c48b6a92f
-
Size
534KB
-
Sample
210301-8agzkgsby6
-
MD5
1a6cd9334c846e9aadb214cce3c0359a
-
SHA1
04536a296bb91ca1b702a2eb8d90fff8a9fe5845
-
SHA256
fbebdf6e8fa43a2458cd66a14dfa5b7127727c55b93a67f40f400e8c48b6a92f
-
SHA512
3e4c35c019076621c785728128c4faf29926371d69a01482558df233de1c74062f77700e6aec1e69f7eec82c11c6f1a21d96e90f0decc189c4ff71f11338bf83
Malware Config
Targets
-
-
Target
fbebdf6e8fa43a2458cd66a14dfa5b7127727c55b93a67f40f400e8c48b6a92f
-
Size
534KB
-
MD5
1a6cd9334c846e9aadb214cce3c0359a
-
SHA1
04536a296bb91ca1b702a2eb8d90fff8a9fe5845
-
SHA256
fbebdf6e8fa43a2458cd66a14dfa5b7127727c55b93a67f40f400e8c48b6a92f
-
SHA512
3e4c35c019076621c785728128c4faf29926371d69a01482558df233de1c74062f77700e6aec1e69f7eec82c11c6f1a21d96e90f0decc189c4ff71f11338bf83
Score10/10-
Contains code to disable Windows Defender
A .NET executable tasked with disabling Windows Defender capabilities such as realtime monitoring, blocking at first seen, etc.
-
Modifies Windows Defender Real-time Protection settings
-
Quasar RAT
Quasar is an open source Remote Access Tool.
-
VenomRAT
VenomRAT is a modified version of QuasarRAT with some added features, such as rootkit and stealer capabilites.
-
Executes dropped EXE
-
Loads dropped DLL
-
Windows security modification
-
Looks up external IP address via web service
Uses a legitimate IP lookup service to find the infected system's external IP.
-