Extracted

• • Target

    f0c295d05e3abafc2d53f0c748a900a3571e1a17ee1754a6f3177266a743c42e

  • Size

    760KB

  • MD5

    e87a4d9bcbb37442e69780961b8fe70d

  • SHA1

    227e974b4ec3a72120cbf2928a673c7162edf2d8

  • SHA256

    f0c295d05e3abafc2d53f0c748a900a3571e1a17ee1754a6f3177266a743c42e

  • SHA512

    88808e1e47b1c81c2577c2846e28d4afb3e19778fbbb17f6ceec93c83be364e50161857c9156c41beb47ccc5bd24442c564117b409068e6db25837e51813d2e5

  Score

  10^/10

  quasarhost persistencespywaretrojanvenomratratrootkitstealer

  • Contains code to disable Windows Defender

    A .NET executable tasked with disabling Windows Defender capabilities such as realtime monitoring, blocking at first seen, etc.

  • Quasar Payload

  • Quasar RAT

    Quasar is an open source Remote Access Tool.

    trojanspywarequasar

  • VenomRAT

    VenomRAT is a modified version of QuasarRAT with some added features, such as rootkit and stealer capabilites.

    ratrootkitstealervenomrat

  • Executes dropped EXE

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Loads dropped DLL

  • Adds Run key to start application

    persistence
  behavioral1behavioral2