Extracted

• • Target

    _-Venom.exe.vir

  • Size

    534KB

  • MD5

    b0f6e15f83e03ea0ab502951b62c3dbf

  • SHA1

    feeb74ad283f27e9eb5e96dccc9fa1c44eab00be

  • SHA256

    6b39407f3c2b6064f483c474c9359f344f2aa8e0afef0941d33deddbc275fdb2

  • SHA512

    8641c8a0b9b46e62a91d2d47a240a8df030394fbf2460d1327428daa46fc8fbf6950d799f9c17c710473712cf44cdb016ba7d4dffeabd6f0912b65874429da45

  Score

  10^/10

  quasarvenomratoffice04ratrootkitspywarestealersuricatatrojan

  • Contains code to disable Windows Defender

    A .NET executable tasked with disabling Windows Defender capabilities such as realtime monitoring, blocking at first seen, etc.

  • Quasar Payload

  • Quasar RAT

    Quasar is an open source Remote Access Tool.

    trojanspywarequasar

  • VenomRAT

    VenomRAT is a modified version of QuasarRAT with some added features, such as rootkit and stealer capabilites.

    ratrootkitstealervenomrat

  • suricata: ET MALWARE Common RAT Connectivity Check Observed

    suricata: ET MALWARE Common RAT Connectivity Check Observed

    suricata

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  behavioral1behavioral2