Extracted

• • Target

    14dc1c330f5e4b976d09b6b0e8c740cac85a1e4ccca18089f9ae693de988996a

  • Size

    601KB

  • MD5

    ac916695fe810d70b17bf78c9474aa4e

  • SHA1

    36d871bd8f2bbd050f5218ad994fbe04d1cfe759

  • SHA256

    14dc1c330f5e4b976d09b6b0e8c740cac85a1e4ccca18089f9ae693de988996a

  • SHA512

    21821fb26a4a3c820f0497d3ed56de66cba7915eb76845e1d1829cff20065ff5909a065e81c6ba44406710d315bd9f1988cb06076047fa5a562ff49a7590730f

  • SSDEEP

    12288:wgxy4jZZ8vDc6h3iUhFbAsUMdzxP0V2t5fI44FPTZFyd:1xy4jZ+vDc05hFXxxEIfhe7yd

  Score

  10^/10

  quasarvenomrathackedevasionpersistenceratrootkitspywarestealertrojan

  • Contains code to disable Windows Defender

    A .NET executable tasked with disabling Windows Defender capabilities such as realtime monitoring, blocking at first seen, etc.

  • Modifies Windows Defender Real-time Protection settings

    evasiontrojan

  • Quasar RAT

    Quasar is an open source Remote Access Tool.

    trojanspywarequasar

  • Quasar payload

  • VenomRAT

    VenomRAT is a modified version of QuasarRAT with some added features, such as rootkit and stealer capabilites.

    ratrootkitstealervenomrat

  • Executes dropped EXE

  • Loads dropped DLL

  • Windows security modification

    evasiontrojan

  • Adds Run key to start application

    persistence

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2