General
-
Target
d9fffd6edeeaeb271645ebd329755660356ed84bbfdd773c7c3aa1d4b594904b
-
Size
534KB
-
Sample
210302-jafrjec49a
-
MD5
3eb993c8d8b647f850cfa469d57a2dec
-
SHA1
da5dc696590815cb6389c693a7edad6e65722c51
-
SHA256
d9fffd6edeeaeb271645ebd329755660356ed84bbfdd773c7c3aa1d4b594904b
-
SHA512
df2b679ea062146b3bb2be292a4ec09671e107abab7fbb7784aa9a78a22baa37e24220796c07b0abbe2cdf6de5b56707567c99ac73badceac075c93482611061
Malware Config
Targets
-
-
Target
d9fffd6edeeaeb271645ebd329755660356ed84bbfdd773c7c3aa1d4b594904b
-
Size
534KB
-
MD5
3eb993c8d8b647f850cfa469d57a2dec
-
SHA1
da5dc696590815cb6389c693a7edad6e65722c51
-
SHA256
d9fffd6edeeaeb271645ebd329755660356ed84bbfdd773c7c3aa1d4b594904b
-
SHA512
df2b679ea062146b3bb2be292a4ec09671e107abab7fbb7784aa9a78a22baa37e24220796c07b0abbe2cdf6de5b56707567c99ac73badceac075c93482611061
Score10/10-
Contains code to disable Windows Defender
A .NET executable tasked with disabling Windows Defender capabilities such as realtime monitoring, blocking at first seen, etc.
-
Modifies Windows Defender Real-time Protection settings
-
Quasar RAT
Quasar is an open source Remote Access Tool.
-
VenomRAT
VenomRAT is a modified version of QuasarRAT with some added features, such as rootkit and stealer capabilites.
-
Executes dropped EXE
-
Loads dropped DLL
-
Windows security modification
-
Looks up external IP address via web service
Uses a legitimate IP lookup service to find the infected system's external IP.
-