quasar | 079f023a20cad36a950144e47b5667949285675703312cf8bf0faf22cb25baf3

General

Target

079f023a20cad36a950144e47b5667949285675703312cf8bf0faf22cb25baf3
Size

659KB
Sample

221125-k65feaah8w
MD5

426930b11ed1690067b11e518ea7f821
SHA1

d5dc533365b757ec442ab28b96602dc9f505e876
SHA256

079f023a20cad36a950144e47b5667949285675703312cf8bf0faf22cb25baf3
SHA512

8a913006aa89eb4f3da5727ddece1185d3fdf8032f575f053b410d99752b9f497c629c68e4253b788e18dc5abb43295ff39bd7e3fd626ab0e7a4684169996231
SSDEEP

12288:NlGTddXPvxy4jZZ8vDc6h3iUhFbAsUMdzxP0V2t5fI44FPTZFyd:vwdtvxy4jZ+vDc05hFXxxEIfhe7yd

Score

10^/10

Malware Config

Extracted

Family

quasar

Version

2.1.0.0

Botnet

hacked

C2

23.105.131.178:7812

Mutex

VNM_MUTEX_0Ae9WwC7TPO9smz3BJ

Attributes

encryption_key
jCEkwlvO5Scyan0S8vZo
install_name
Windows Security Health Service.exe
log_directory
Logs
reconnect_delay
3000
startup_key
Windows Update
subdirectory
Microsoft

Targets

- Target
  
  079f023a20cad36a950144e47b5667949285675703312cf8bf0faf22cb25baf3
- Size
  
  659KB
- MD5
  
  426930b11ed1690067b11e518ea7f821
- SHA1
  
  d5dc533365b757ec442ab28b96602dc9f505e876
- SHA256
  
  079f023a20cad36a950144e47b5667949285675703312cf8bf0faf22cb25baf3
- SHA512
  
  8a913006aa89eb4f3da5727ddece1185d3fdf8032f575f053b410d99752b9f497c629c68e4253b788e18dc5abb43295ff39bd7e3fd626ab0e7a4684169996231
- SSDEEP
  
  12288:NlGTddXPvxy4jZZ8vDc6h3iUhFbAsUMdzxP0V2t5fI44FPTZFyd:vwdtvxy4jZ+vDc05hFXxxEIfhe7yd
Score

10^/10

quasar venomrat hacked evasion persistence rat rootkit spyware stealer trojan
- Contains code to disable Windows Defender
  A .NET executable tasked with disabling Windows Defender capabilities such as realtime monitoring, blocking at first seen, etc.
- Modifies Windows Defender Real-time Protection settings
  evasion trojan
- Quasar RAT
  Quasar is an open source Remote Access Tool.
  trojan spyware quasar
- Quasar payload
- VenomRAT
  VenomRAT is a modified version of QuasarRAT with some added features, such as rootkit and stealer capabilites.
  rat rootkit stealer venomrat
- Executes dropped EXE
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Loads dropped DLL
- Windows security modification
  evasion trojan
- Adds Run key to start application
  persistence
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
- Suspicious use of SetThreadContext
behavioral1 behavioral2