General
-
Target
OTP BOT CRACKED.exe
-
Size
692KB
-
Sample
230120-3w971sca4t
-
MD5
57142dab96fabd2d6c9361ebf8a9b2b2
-
SHA1
46d08ee2df6df25352ef2b310bff8e42e99e6166
-
SHA256
3b2166067b82633f6773b3da714db496796054a315d6c870763e1a4641c6821c
-
SHA512
215facd7e421647391055ac823d27d15f8d90e45e88002305c2028e2c29a4828fc05f69858d84c96dfa44cbb372a64a21d02c60c756941e48080925e7e8dd331
-
SSDEEP
12288:FgHxLPNU1AoiCepLYI2UH92+JlAlB3GQrrCEvL6Dd6S7sQo:ilXoApNTH9eGQrrCE47s
Malware Config
Extracted
quasar
2.1.0.0
FINAL
192.253.245.243:7812
VNM_MUTEX_qM9TbqrSltZ0u3P1Qz
-
encryption_key
KCyrElxCqTCYe4YGdIaR
-
install_name
Windows Security.exe
-
log_directory
Logs
-
reconnect_delay
3000
-
startup_key
Windows Update
-
subdirectory
Windows Security Service
Targets
-
-
Target
OTP BOT CRACKED.exe
-
Size
692KB
-
MD5
57142dab96fabd2d6c9361ebf8a9b2b2
-
SHA1
46d08ee2df6df25352ef2b310bff8e42e99e6166
-
SHA256
3b2166067b82633f6773b3da714db496796054a315d6c870763e1a4641c6821c
-
SHA512
215facd7e421647391055ac823d27d15f8d90e45e88002305c2028e2c29a4828fc05f69858d84c96dfa44cbb372a64a21d02c60c756941e48080925e7e8dd331
-
SSDEEP
12288:FgHxLPNU1AoiCepLYI2UH92+JlAlB3GQrrCEvL6Dd6S7sQo:ilXoApNTH9eGQrrCE47s
Score10/10-
Contains code to disable Windows Defender
A .NET executable tasked with disabling Windows Defender capabilities such as realtime monitoring, blocking at first seen, etc.
-
Modifies Windows Defender Real-time Protection settings
-
Quasar RAT
Quasar is an open source Remote Access Tool.
-
Quasar payload
-
VenomRAT
VenomRAT is a modified version of QuasarRAT with some added features, such as rootkit and stealer capabilites.
-
Executes dropped EXE
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Deletes itself
-
Loads dropped DLL
-
Windows security modification
-
Adds Run key to start application
-
Looks up external IP address via web service
Uses a legitimate IP lookup service to find the infected system's external IP.
-