quasar | e14fe9800b600ce61b06794233aa47d6fbbc20d18dbb1e531c5deaac995bbca8

General

Target

e14fe9800b600ce61b06794233aa47d6fbbc20d18dbb1e531c5deaac995bbca8
Size

590KB
Sample

221130-q43fxsfa84
MD5

f7d70adb404cf63562d6541fce16ee94
SHA1

7c855ae562c54c6747c682f9403ff902308deeb1
SHA256

e14fe9800b600ce61b06794233aa47d6fbbc20d18dbb1e531c5deaac995bbca8
SHA512

aed0a69aa45018197f04eec259ab4954f0ecd6f0e309a745346282cc46efd4e6567f920a3cfa39326082abff40de6ad932150ae5f6207e1a580d87343410d519
SSDEEP

6144:kU9/iRCAm9wyitWVSIyIXQR3YQJrjYPUotecWo7vMyYp5lQj64cmX3Hrv9Otawza:i3ynm3RsPj7WYUxp+TvotLzAFLBz8LS

Score

10^/10

Malware Config

Extracted

Family

quasar

Version

2.1.0.0

Botnet

RAT

C2

23.105.131.178:7812

Mutex

VNM_MUTEX_gdy9bWxR0te3WgTRnI

Attributes

encryption_key
MDXzdQumRqZGIeya7nG9
install_name
Windows Defender Security.exe
log_directory
Logs
reconnect_delay
3000
startup_key
Windows Update
subdirectory
Microsoft

Targets

- Target
  
  e14fe9800b600ce61b06794233aa47d6fbbc20d18dbb1e531c5deaac995bbca8
- Size
  
  590KB
- MD5
  
  f7d70adb404cf63562d6541fce16ee94
- SHA1
  
  7c855ae562c54c6747c682f9403ff902308deeb1
- SHA256
  
  e14fe9800b600ce61b06794233aa47d6fbbc20d18dbb1e531c5deaac995bbca8
- SHA512
  
  aed0a69aa45018197f04eec259ab4954f0ecd6f0e309a745346282cc46efd4e6567f920a3cfa39326082abff40de6ad932150ae5f6207e1a580d87343410d519
- SSDEEP
  
  6144:kU9/iRCAm9wyitWVSIyIXQR3YQJrjYPUotecWo7vMyYp5lQj64cmX3Hrv9Otawza:i3ynm3RsPj7WYUxp+TvotLzAFLBz8LS
Score

10^/10

quasar venomrat rat evasion persistence rat rootkit spyware stealer trojan
- Contains code to disable Windows Defender
  A .NET executable tasked with disabling Windows Defender capabilities such as realtime monitoring, blocking at first seen, etc.
- Modifies Windows Defender Real-time Protection settings
  evasion trojan
- Quasar RAT
  Quasar is an open source Remote Access Tool.
  trojan spyware quasar
- Quasar payload
- VenomRAT
  VenomRAT is a modified version of QuasarRAT with some added features, such as rootkit and stealer capabilites.
  rat rootkit stealer venomrat
- Executes dropped EXE
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Deletes itself
- Loads dropped DLL
- Windows security modification
  evasion trojan
- Adds Run key to start application
  persistence
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
behavioral1 behavioral2