Extracted

• • Target
    9c8ea131bde14b5038358c608f55b0238e3610ceb8503b32527ae936221e862e
  • Size 725KB
  • SHA256 9c8ea131bde14b5038358c608f55b0238e3610ceb8503b32527ae936221e862e
  • MD5 a7ab1b1d14ae721f0ed0b0b828feb078
  • SHA1 bcb83a1665a7a1436af50ef13d01e78303f349c0
  • SHA512 0d8e7cf0fe51b9f695debce7a37d721992f88f574095c96152fb15bff6c0ab1b1574495c793cc6a1446031c9c8069d2ff3c3bca7f8acc9e16dcd7168236a4118
  • MD5 SHA1 SHA512

  Score

  10^/10

  quasarvenomratmundoratrootkitspywarestealertrojansuricata

  • Contains code to disable Windows Defender

    A .NET executable tasked with disabling Windows Defender capabilities such as realtime monitoring, blocking at first seen, etc.

  • Quasar Payload

  • Quasar RAT

    Quasar is an open source Remote Access Tool.

    trojanspywarequasar

  • VenomRAT

    VenomRAT is a modified version of QuasarRAT with some added features, such as rootkit and stealer capabilites.

    ratrootkitstealervenomrat

  • suricata: ET MALWARE W32/Quasar 1.3/Venom RAT Connectivity Check 3

    suricata: ET MALWARE W32/Quasar 1.3/Venom RAT Connectivity Check 3

    suricata

  • Executes dropped EXE

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Loads dropped DLL

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  behavioral1behavioral2