quasar | bb49e8609de534fee476cdc8a0db81248e169f023a2ac7d7e8fae21127a03660

General

Target

BitRat Cracked.7z
Size

53.9MB
Sample

230113-nt4vwscc7t
MD5

9cda41c593351507168bdf8e26773554
SHA1

65dbd0918163dac4834cd46fbeff4b36789c5d52
SHA256

bb49e8609de534fee476cdc8a0db81248e169f023a2ac7d7e8fae21127a03660
SHA512

8ddcca1bfd5d54b277f8f333c1e46e71f62396bcd0e692c2d11a4db61c07397f634d0f71d358a49a14c2a7cfc1cc994f1084aed4d00a1fe52db6aeadda6c7498
SSDEEP

786432:6oyMDzbdqWhTUsEP/NvI7vQo0bQeVo7hBALehzuywYFucNaxY9Hr4TjCNR46hGIL:EMBqWxUXNvEzip8wawYFucNaxY9H0jCP

Score

10^/10

Malware Config

Extracted

Family

quasar

Version

2.1.0.0

Botnet

Office04

C2

smtp.yassine-bolard.nl:72

82.65.150.176:72

Mutex

VNM_MUTEX_c2q7y2ayYutZ2XaYe7

Attributes

encryption_key
oacDd8MguAxsN1YILaEK
install_name
$77Discord.exe
log_directory
Logs
reconnect_delay
3000
startup_key
Discord_Update
subdirectory
Discord_Updater

Targets

- Target
  
  BitRat Cracked.exe
- Size
  
  28.7MB
- MD5
  
  cf7429f7c62ad8bd2e3badc42befbb3a
- SHA1
  
  c93f97d3db5e3ee06611ca4b4e037d024098e94f
- SHA256
  
  a52e2fd8be23a1efd9eb4d0b165f30a089c129a790c9d4b65acef032fbd44c8e
- SHA512
  
  5cc5ed688d3a83087f59141adf32d8e37678e483170bdfdced8bc7d287e4b8a521d526265068d7c423f5582522e315283cece5e32480b4d8c5dabf506609f565
- SSDEEP
  
  393216:6oirBgdxc1lGOHYae79hLhq3QXCjHnLAusN/IaXwQVL9YbE0kmCGJ6GLR5YjIn4S:H/TOHCHtq3QXCT4t79YbE0RJPOxtH5O
Score

10^/10

quasar venomrat office04 evasion rat rootkit spyware stealer trojan
- Contains code to disable Windows Defender
  A .NET executable tasked with disabling Windows Defender capabilities such as realtime monitoring, blocking at first seen, etc.
- Modifies Windows Defender Real-time Protection settings
  evasion trojan
- Quasar RAT
  Quasar is an open source Remote Access Tool.
  trojan spyware quasar
- Quasar payload
- VenomRAT
  VenomRAT is a modified version of QuasarRAT with some added features, such as rootkit and stealer capabilites.
  rat rootkit stealer venomrat
- Nirsoft
- Executes dropped EXE
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Loads dropped DLL
- Windows security modification
  evasion trojan
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
- Drops file in System32 directory
behavioral1
- Target
  
  BitShitBuilder.exe
- Size
  
  10.5MB
- MD5
  
  6b52d094d85c112904e314bc3b939542
- SHA1
  
  f97dab5fd7327ecb32eabb294653c29decdcb6a5
- SHA256
  
  1e982fc30c7a64c12d18cc2d13a25085e9c8ee0fab379665c6d011539179a76f
- SHA512
  
  76d353d46c75b579e62073bc330a89b4356967006781bc78c39a6ed87fd28007454e7f2c58bae6532ca4419cce9f8230e577234fc35251527dffa1c330f291b8
- SSDEEP
  
  196608:snxz4b91Lxr++yat8a2ZhcR+1Fm9FN38V6eBJBwkZuK:Yp4bkat8aghcR+1FgFp8pDHj
Score

7^/10
- Loads dropped DLL
- Suspicious use of NtSetInformationThreadHideFromDebugger
behavioral2
- Target
  
  data/modules/hvnc.exe
- Size
  
  98KB
- MD5
  
  46cc5f3e84be163470d41fcb03818dc3
- SHA1
  
  fc9b8b814238d4a3f37c031a03582e7ebacb2bd8
- SHA256
  
  1951ea19261e1f11868ca99b5ccb7ac7bf94363cb4140eb0f85f527b88d5b5c6
- SHA512
  
  338e801c5d7b8c75ac20b14828fecf1ee02007c3a86b6d234b6f333201bd6f54b4c51404f778843f0cc2772eb04e9f5b8a9383e77e8e570b29b36f97120d435c
- SSDEEP
  
  3072:GI4YTY4x4/kthLvSEbXOLJp+rKRwK720R2N9o1tzF:GI4ap2/UvH+vIu9F
Score

1^/10
behavioral3
- Target
  
  data/tor/tor.exe
- Size
  
  3.9MB
- MD5
  
  52faae579cc30d277fddf60ea4b89e2c
- SHA1
  
  f2010f4451c7aac3c767a5743370d9252bbbfd7c
- SHA256
  
  c4ee142394bf7a53e43ca86ab3c03e3712d85c15941588fc4e6e8f5c7a88c654
- SHA512
  
  3baec48c1718f2252ce788b3832d3adf145f93c3a9e6e6aeabde6d5d5d52bde32c450c46b1385961bf201c30f60570319897f614428414534867af6bf93f16a4
- SSDEEP
  
  98304:CzZ42i53gAUP71HtcjRkVfQIjiEsgYY9l7:KOaA0HtcjKVfQIb
Score

3^/10
behavioral4