quasar | 7cbcebf57f666bc42f8e6b3bba459cf968d19690e7d983e943b77fb97acb487d

General

Target

7cbcebf57f666bc42f8e6b3bba459cf968d19690e7d983e943b77fb97acb487d
Size

1.0MB
Sample

230129-v3lt1aha2w
MD5

1def40ae6fbb8b8f438b7370a6f4ab2d
SHA1

0f59d0792f223b54901e109f5ae98a3ec4acc049
SHA256

7cbcebf57f666bc42f8e6b3bba459cf968d19690e7d983e943b77fb97acb487d
SHA512

f3554bf9d7ba8bd1fbe137c4da19b99a2f486456b3e61e909b3b13af724244d9fe0cf421678d247ceb3934d1c928d203847a4e487f3fcf797cdc45a86ffd599d
SSDEEP

24576:+cvkTLn+3Z3dwNTY8wKxHCtAxlSPU5JpoLww2A716yGGMaYnHfGZgj9h1i:ZvkTD+3Z3ypYNKBIAzSPwD8EQ/q/qgI

Score

10^/10

Malware Config

Extracted

Family

quasar

Version

2.1.0.0

Botnet

Office04

C2

127.0.0.1:4782

rat94522.ddnsking.com:4000

Mutex

VNM_MUTEX_c2q7y2ayYutZ2XaYe7

Attributes

encryption_key
WIwQFd2V7FhUXFH7QX71
install_name
Client.exe
log_directory
Logs
reconnect_delay
3000
startup_key
Venom Client Startup
subdirectory
SubDir

Targets

- Target
  
  7cbcebf57f666bc42f8e6b3bba459cf968d19690e7d983e943b77fb97acb487d
- Size
  
  1.0MB
- MD5
  
  1def40ae6fbb8b8f438b7370a6f4ab2d
- SHA1
  
  0f59d0792f223b54901e109f5ae98a3ec4acc049
- SHA256
  
  7cbcebf57f666bc42f8e6b3bba459cf968d19690e7d983e943b77fb97acb487d
- SHA512
  
  f3554bf9d7ba8bd1fbe137c4da19b99a2f486456b3e61e909b3b13af724244d9fe0cf421678d247ceb3934d1c928d203847a4e487f3fcf797cdc45a86ffd599d
- SSDEEP
  
  24576:+cvkTLn+3Z3dwNTY8wKxHCtAxlSPU5JpoLww2A716yGGMaYnHfGZgj9h1i:ZvkTD+3Z3ypYNKBIAzSPwD8EQ/q/qgI
Score

10^/10

quasar venomrat office04 evasion rat rootkit spyware stealer trojan
- Contains code to disable Windows Defender
  A .NET executable tasked with disabling Windows Defender capabilities such as realtime monitoring, blocking at first seen, etc.
- Modifies Windows Defender Real-time Protection settings
  evasion trojan
- Quasar RAT
  Quasar is an open source Remote Access Tool.
  trojan spyware quasar
- Quasar payload
- VenomRAT
  VenomRAT is a modified version of QuasarRAT with some added features, such as rootkit and stealer capabilites.
  rat rootkit stealer venomrat
- Executes dropped EXE
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Deletes itself
- Loads dropped DLL
- Windows security modification
  evasion trojan
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
behavioral1 behavioral2