Extracted

• • Target

    77d715446ad952471a2a93e3f04f51a002086e90b5fd80f74e59acbbd4a9faa1

  • Size

    724KB

  • MD5

    e6a103fe244837f1d9b3aef62ac0d29f

  • SHA1

    b14829bd20c77dcf84edea4625d7320897983e20

  • SHA256

    77d715446ad952471a2a93e3f04f51a002086e90b5fd80f74e59acbbd4a9faa1

  • SHA512

    9d04008c4c5fc4994b1f42a6e5e03473e941215ea62f47cae321202f078dd5e3b1ce914549cab090b372e03db62d8399f621695e219f592094e27d7613009bed

  Score

  10^/10

  quasarvenomratoffice04ratrootkitspywarestealertrojan

  • Contains code to disable Windows Defender

    A .NET executable tasked with disabling Windows Defender capabilities such as realtime monitoring, blocking at first seen, etc.

  • Quasar Payload

  • Quasar RAT

    Quasar is an open source Remote Access Tool.

    trojanspywarequasar

  • VenomRAT

    VenomRAT is a modified version of QuasarRAT with some added features, such as rootkit and stealer capabilites.

    ratrootkitstealervenomrat

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2