Overview

overview

10

Static

static

026beaf36c...d3.exe

windows7_x64

10

026beaf36c...d3.exe

windows10-2004_x64

3

Analysis

  • max time kernel
    167s
  • max time network
    195s
  • platform
    windows7_x64
  • resource
    win7-20220414-en
  • submitted
    08-05-2022 07:29

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    026beaf36cb34931a5e173f71873b451ef43a889c1c09aa0b071641c6c3345d3.exe

  • Size

    15.0MB

  • MD5

    35ecc52f8d324f88c65432ca49d6f223

  • SHA1

    4102ef0264dac3521052e1acb32bca0c12162cae

  • SHA256

    026beaf36cb34931a5e173f71873b451ef43a889c1c09aa0b071641c6c3345d3

  • SHA512

    e91092fc235acda0f9d71e3867f11b3c237627aa69049a8588b3466e3efb09663eab11f046e56f9b87aaa988322c0e1d8ea1278565624c152922da8972e1a50a

Score
10/10
quasarvenomratwindirevasionpersistenceratrootkitspywarestealersuricatatrojan

Malware Config

Extracted

Family

quasar

Version

2.1.0.0

Botnet

WinDir

C2

0.tcp.ngrok.io:18130

Mutex

VNM_MUTEX_kdX9JMeh4Tx0gANlkq

Attributes
  • encryption_key

    4z4UlPgqlyr06tHY9YuZ

  • install_name

    WindowsSystemDirectoryManager.exe

  • log_directory

    JR_DIR

  • reconnect_delay

    3000

  • startup_key

    WindowsSystemDirectoryManager

  • subdirectory

    WinSysDir

Signatures

  • Contains code to disable Windows Defender 8 IoCs

    A .NET executable tasked with disabling Windows Defender capabilities such as realtime monitoring, blocking at first seen, etc.

  • Modifies Windows Defender Real-time Protection settings 3 TTPs
    evasiontrojan
  • Quasar Payload 8 IoCs
  • Quasar RAT 3 IoCs

    Quasar is an open source Remote Access Tool.

    trojanspywarequasar