Extracted

• • Target

    1c3f6fdf457783325a5335780144cf45

  • Size

    534KB

  • MD5

    1c3f6fdf457783325a5335780144cf45

  • SHA1

    89385be28336082cd95cf5bf11dccb2f4b60a9f0

  • SHA256

    b443a89281aa4bb8d955cb3f2b34208332cb01243602f77a4dc323237e069455

  • SHA512

    15bdb064e65867e49e41943a95ed03214df8a0a4804b03515947e101be99317f385e9b94516fbcd5bafaaf0deb57a1a3e05f54bf5e042b38c16a1231ab3c7806

  Score

  10^/10

  quasarvenomratoffice04ratrootkitspywarestealersuricatatrojan

  • Contains code to disable Windows Defender

    A .NET executable tasked with disabling Windows Defender capabilities such as realtime monitoring, blocking at first seen, etc.

  • Quasar RAT

    Quasar is an open source Remote Access Tool.

    trojanspywarequasar

  • Quasar payload

  • VenomRAT

    VenomRAT is a modified version of QuasarRAT with some added features, such as rootkit and stealer capabilites.

    ratrootkitstealervenomrat

  • suricata: ET MALWARE Common RAT Connectivity Check Observed

    suricata: ET MALWARE Common RAT Connectivity Check Observed

    suricata

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  behavioral1behavioral2