quasar | af1d446bb3abc47b5eacb7a00ebb1992be1c464cac5b0e4283b12f0500c3ad4e

General

Target

af1d446bb3abc47b5eacb7a00ebb1992be1c464cac5b0e4283b12f0500c3ad4e
Size

534KB
Sample

221014-frhkwahch5
MD5

17e6bffaff1ea223913deb1bc78e74ae
SHA1

67daf17f3c8f6d2169b24f9a3698921991bbba2f
SHA256

af1d446bb3abc47b5eacb7a00ebb1992be1c464cac5b0e4283b12f0500c3ad4e
SHA512

72086bdd67ce5c778a625d37d7069200747b70193742afee986ec3d58b3a4a5c95b206c91997faf5d3e46e7ab379955db5f033a8b10a4a4899ff6e6068c60ab6
SSDEEP

6144:l8fGABIgrx8kFYLTiMkbMaOcXL/Tb88ASigvCcD+6cfsfiTDpxUKl3Gy3V8/GV0S:EPx7FYPiMNA/flvCcqTsfGpxLl+u

Score

10^/10

Malware Config

Extracted

Family

quasar

Version

2.1.0.0

Botnet

asdf

C2

checkme12.freeddns.org:1604

Mutex

VNM_MUTEX_yidaALoSEROfTPWHwX

Attributes

encryption_key
TbfVFQWqb0uiZoBjJ9E9
install_name
Client.exe
log_directory
Logs
reconnect_delay
3000
startup_key
Venom Client Startup
subdirectory
UPX

Targets

- Target
  
  af1d446bb3abc47b5eacb7a00ebb1992be1c464cac5b0e4283b12f0500c3ad4e
- Size
  
  534KB
- MD5
  
  17e6bffaff1ea223913deb1bc78e74ae
- SHA1
  
  67daf17f3c8f6d2169b24f9a3698921991bbba2f
- SHA256
  
  af1d446bb3abc47b5eacb7a00ebb1992be1c464cac5b0e4283b12f0500c3ad4e
- SHA512
  
  72086bdd67ce5c778a625d37d7069200747b70193742afee986ec3d58b3a4a5c95b206c91997faf5d3e46e7ab379955db5f033a8b10a4a4899ff6e6068c60ab6
- SSDEEP
  
  6144:l8fGABIgrx8kFYLTiMkbMaOcXL/Tb88ASigvCcD+6cfsfiTDpxUKl3Gy3V8/GV0S:EPx7FYPiMNA/flvCcqTsfGpxLl+u
Score

10^/10

quasar venomrat asdf evasion persistence rat rootkit spyware stealer trojan
- Contains code to disable Windows Defender
  A .NET executable tasked with disabling Windows Defender capabilities such as realtime monitoring, blocking at first seen, etc.
- Modifies Windows Defender Real-time Protection settings
  evasion trojan
- Quasar RAT
  Quasar is an open source Remote Access Tool.
  trojan spyware quasar
- Quasar payload
- VenomRAT
  VenomRAT is a modified version of QuasarRAT with some added features, such as rootkit and stealer capabilites.
  rat rootkit stealer venomrat
- Executes dropped EXE
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Windows security modification
  evasion trojan
- Adds Run key to start application
  persistence
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
behavioral1