Overview

overview

10

Static

static

10

2cb7320819...97.exe

windows7_x64

10

2cb7320819...97.exe

windows10_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    2cb7320819f358b11ee7187ce04909d13edeedbbd106fb7a0d32bc594ed5f097

  • Size

    534KB

  • Sample

    210629-6ja3ljhfp2

  • MD5

    1e4df0eb1af664a6a5565f7c1d8d03c5

  • SHA1

    1334395725da44185b583b848de3a34d7a35ddc9

  • SHA256

    2cb7320819f358b11ee7187ce04909d13edeedbbd106fb7a0d32bc594ed5f097

  • SHA512

    e7845c88993974310626c9d126f92849e59529e7107c775a6536736b022992f8e1b581db323a75f7040ba4219da669f2fa899fa38cc14bcb0e4ab0ca1bbe9a73

Score
10/10
quasarvenomratoffice04ratrootkitstealer

Malware Config

Extracted

Family

quasar

Version

2.1.0.0

Botnet

Office04

C2

127.0.0.1:4782

Mutex

VNM_MUTEX_c2q7y2ayYutZ2XaYe7

Attributes
  • encryption_key

    QfW91vzgIrZEHqOOwPL3

  • install_name

    Client.exe

  • log_directory

    Logs

  • reconnect_delay

    3000

  • startup_key

    Venom Client Startup

  • subdirectory

    SubDir

Targets

    • Target

      2cb7320819f358b11ee7187ce04909d13edeedbbd106fb7a0d32bc594ed5f097

    • Size

      534KB

    • MD5

      1e4df0eb1af664a6a5565f7c1d8d03c5

    • SHA1

      1334395725da44185b583b848de3a34d7a35ddc9

    • SHA256

      2cb7320819f358b11ee7187ce04909d13edeedbbd106fb7a0d32bc594ed5f097

    • SHA512

      e7845c88993974310626c9d126f92849e59529e7107c775a6536736b022992f8e1b581db323a75f7040ba4219da669f2fa899fa38cc14bcb0e4ab0ca1bbe9a73

    Score
    10/10
    venomratratrootkitstealer

    • VenomRAT

      VenomRAT is a modified version of QuasarRAT with some added features, such as rootkit and stealer capabilites.

      ratrootkitstealervenomrat

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    behavioral1behavioral2

MITRE ATT&CK Matrix

Tasks