quasar | 94dc30c7b03813bb558ec30577f0761dc2bfcedd3aa0dea665a88ab84f08aa33

General

Target

94dc30c7b03813bb558ec30577f0761dc2bfcedd3aa0dea665a88ab84f08aa33
Size

680KB
Sample

221130-rtfd3shb26
MD5

4f99850bfde0c6703b4f2c8420b9dc8f
SHA1

c60d92f1e0529b2e770858e180906bf9fae631a9
SHA256

94dc30c7b03813bb558ec30577f0761dc2bfcedd3aa0dea665a88ab84f08aa33
SHA512

0d311592bc2dc5ececb3afae6dee5842b9f6a37710d29f5f1a3fe8a27d3e43a625a57039bef92044744d8a0225c52260cc9757b148deb9e0c4e72781e1a89aec
SSDEEP

12288:75393whFOBbQVXQsI6f9fqAPzzEeEZchCBywRiaxJDj8DkIonQmP0Ove/diuHc:753uhF7VAibzzEe9wRiaLSkI8QhOQ18

Score

10^/10

Malware Config

Extracted

Family

quasar

Version

2.1.0.0

Botnet

ajith

C2

23.105.131.178:7812

Mutex

VNM_MUTEX_NdVd2sPSSqFdo7I35g

Attributes

encryption_key
jyerms3KOWmt3C9DBFuq
install_name
Windows Defender Security.exe
log_directory
Logs
reconnect_delay
3000
startup_key
Windows Update
subdirectory
SubDir

Targets

- Target
  
  94dc30c7b03813bb558ec30577f0761dc2bfcedd3aa0dea665a88ab84f08aa33
- Size
  
  680KB
- MD5
  
  4f99850bfde0c6703b4f2c8420b9dc8f
- SHA1
  
  c60d92f1e0529b2e770858e180906bf9fae631a9
- SHA256
  
  94dc30c7b03813bb558ec30577f0761dc2bfcedd3aa0dea665a88ab84f08aa33
- SHA512
  
  0d311592bc2dc5ececb3afae6dee5842b9f6a37710d29f5f1a3fe8a27d3e43a625a57039bef92044744d8a0225c52260cc9757b148deb9e0c4e72781e1a89aec
- SSDEEP
  
  12288:75393whFOBbQVXQsI6f9fqAPzzEeEZchCBywRiaxJDj8DkIonQmP0Ove/diuHc:753uhF7VAibzzEe9wRiaLSkI8QhOQ18
Score

10^/10

quasar venomrat ajith evasion persistence rat rootkit spyware stealer trojan
- Contains code to disable Windows Defender
  A .NET executable tasked with disabling Windows Defender capabilities such as realtime monitoring, blocking at first seen, etc.
- Modifies Windows Defender Real-time Protection settings
  evasion trojan
- Quasar RAT
  Quasar is an open source Remote Access Tool.
  trojan spyware quasar
- Quasar payload
- VenomRAT
  VenomRAT is a modified version of QuasarRAT with some added features, such as rootkit and stealer capabilites.
  rat rootkit stealer venomrat
- Executes dropped EXE
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Deletes itself
- Loads dropped DLL
- Windows security modification
  evasion trojan
- Adds Run key to start application
  persistence
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
- Suspicious use of SetThreadContext
behavioral1 behavioral2