Overview

overview

10

Static

static

8c274dad5f...26.exe

windows7-x64

10

8c274dad5f...26.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    8c274dad5fd77b0692ca5c299ffb0d26.exe

  • Size

    536KB

  • Sample

    230119-k5llxace4y

  • MD5

    8c274dad5fd77b0692ca5c299ffb0d26

  • SHA1

    5dda42516b5f3b65093dae4b55506e9c8813d745

  • SHA256

    75031e206522faaec5981f7cf411472b23ee0508748cd5c1453e390c6facffc8

  • SHA512

    370c2b2f4a2342b1d3281e2b8d2a426606e0e828b4342981bcd42b16f78dd071d419d646e3c94292cf11e287347b48f2231de91a21ff2856ea08e2085da335b9

  • SSDEEP

    12288:k04p+yRb8qXeSCTQVpyQJPiDZOjVYXRTyyss:k0M8qXzCTQ/yQWRyq

Score
10/10
quasarvenomratoffice01evasionratrootkitspywarestealertrojan

Malware Config

Extracted

Family

quasar

Version

2.1.0.0

Botnet

Office01

C2

172.81.131.113:4782

Mutex

VNM_MUTEX_OFUOtYdHQP7Y7fAk1P

Attributes
  • encryption_key

    xufMEowCMSpdPlEx87tq

  • install_name

    Client.exe

  • log_directory

    Logs

  • reconnect_delay

    3000

  • startup_key

    mvscs

  • subdirectory

    SubDir

Targets

    • Target

      8c274dad5fd77b0692ca5c299ffb0d26.exe

    • Size

      536KB

    • MD5

      8c274dad5fd77b0692ca5c299ffb0d26

    • SHA1

      5dda42516b5f3b65093dae4b55506e9c8813d745

    • SHA256

      75031e206522faaec5981f7cf411472b23ee0508748cd5c1453e390c6facffc8

    • SHA512

      370c2b2f4a2342b1d3281e2b8d2a426606e0e828b4342981bcd42b16f78dd071d419d646e3c94292cf11e287347b48f2231de91a21ff2856ea08e2085da335b9

    • SSDEEP

      12288:k04p+yRb8qXeSCTQVpyQJPiDZOjVYXRTyyss:k0M8qXzCTQ/yQWRyq

    Score
    10/10
    quasarvenomratoffice01evasionratrootkitspywarestealertrojan

    • Contains code to disable Windows Defender

      A .NET executable tasked with disabling Windows Defender capabilities such as realtime monitoring, blocking at first seen, etc.

    • Modifies Windows Defender Real-time Protection settings

      evasiontrojan

    • Quasar RAT

      Quasar is an open source Remote Access Tool.

      trojanspywarequasar

    • Quasar payload

    • VenomRAT

      VenomRAT is a modified version of QuasarRAT with some added features, such as rootkit and stealer capabilites.

      ratrootkitstealervenomrat

    • Executes dropped EXE

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Deletes itself

    • Loads dropped DLL

    • Windows security modification

      evasiontrojan

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scheduled Task

1
T1053

Persistence

Modify Existing Service

1
T1031

Scheduled Task

1
T1053

Privilege Escalation

Scheduled Task

1
T1053

Defense Evasion

Modify Registry

3
T1112

Disabling Security Tools

2
T1089

Install Root Certificate

1
T1130

Credential Access

Discovery

Query Registry

1
T1012

System Information Discovery

2
T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks