Overview

overview

10

Static

static

10

2c73be6b37...cb.exe

windows7_x64

10

2c73be6b37...cb.exe

windows10_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    2c73be6b374db37dd28a204f49d78a61ebcc678a9164828b9f01e50e06ece3cb

  • Size

    534KB

  • Sample

    210302-tr5hl5pwka

  • MD5

    fda53610c25408e427c84eebdc5b8ec2

  • SHA1

    13830e44fb35c5f6d4750abd620ecb4df85e7a6a

  • SHA256

    2c73be6b374db37dd28a204f49d78a61ebcc678a9164828b9f01e50e06ece3cb

  • SHA512

    617b6fb67057c7207cbe9f73be85b6f4d9d69462aee9b526a1bea085d1c101f7ff9da98da6a0e266bd49cafc41c0cdb741453bc76e9c09011bf4f1ec446f52e7

Score
10/10
quasarvenomratevasionratrootkitspywarestealertrojan

Malware Config

Targets

    • Target

      2c73be6b374db37dd28a204f49d78a61ebcc678a9164828b9f01e50e06ece3cb

    • Size

      534KB

    • MD5

      fda53610c25408e427c84eebdc5b8ec2

    • SHA1

      13830e44fb35c5f6d4750abd620ecb4df85e7a6a

    • SHA256

      2c73be6b374db37dd28a204f49d78a61ebcc678a9164828b9f01e50e06ece3cb

    • SHA512

      617b6fb67057c7207cbe9f73be85b6f4d9d69462aee9b526a1bea085d1c101f7ff9da98da6a0e266bd49cafc41c0cdb741453bc76e9c09011bf4f1ec446f52e7

    Score
    10/10
    quasarvenomratevasionratrootkitspywarestealertrojan

    • Contains code to disable Windows Defender

      A .NET executable tasked with disabling Windows Defender capabilities such as realtime monitoring, blocking at first seen, etc.

    • Modifies Windows Defender Real-time Protection settings

      evasiontrojan

    • Quasar RAT

      Quasar is an open source Remote Access Tool.

      trojanspywarequasar

    • VenomRAT

      VenomRAT is a modified version of QuasarRAT with some added features, such as rootkit and stealer capabilites.

      ratrootkitstealervenomrat

    • Executes dropped EXE

    • Loads dropped DLL

    • Windows security modification

      evasiontrojan

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks