quasar | d5f6dbe3d6f5644a77d7a3971d9dd17caec494ced43ffc535473b285b0f1507e

General

Target

d5f6dbe3d6f5644a77d7a3971d9dd17caec494ced43ffc535473b285b0f1507e
Size

1.0MB
Sample

230129-v3nzcsha2x
MD5

d7ddd317f0382a2200832312449a20cd
SHA1

bd3710cff6322c6a372db549b637c32e383f05cc
SHA256

d5f6dbe3d6f5644a77d7a3971d9dd17caec494ced43ffc535473b285b0f1507e
SHA512

c3936a1943575b0bb9dfdf8fef0d9705fc08c275260ce8199b7ff13213b72173565e7c1a4dfd47bd4a5a592ce10749ff1dafe73ba0053c9bd8f7a8cee495407d
SSDEEP

24576:WcvkT1s+3Z3aGWqKg0Ogj1OLHd+JwbMFdt6ATCRcaahwKHGaTKBupdl:hvkTq+3Z3ZWGsSHd+J+MFTsRcXnHGmKm

Score

10^/10

Malware Config

Extracted

Family

quasar

Version

2.1.0.0

Botnet

Office04

C2

127.0.0.1:4782

rat94522.ddnsking.com:4000

Mutex

VNM_MUTEX_c2q7y2ayYutZ2XaYe7

Attributes

encryption_key
WIwQFd2V7FhUXFH7QX71
install_name
Client.exe
log_directory
Logs
reconnect_delay
3000
startup_key
Venom Client Startup
subdirectory
SubDir

Targets

- Target
  
  d5f6dbe3d6f5644a77d7a3971d9dd17caec494ced43ffc535473b285b0f1507e
- Size
  
  1.0MB
- MD5
  
  d7ddd317f0382a2200832312449a20cd
- SHA1
  
  bd3710cff6322c6a372db549b637c32e383f05cc
- SHA256
  
  d5f6dbe3d6f5644a77d7a3971d9dd17caec494ced43ffc535473b285b0f1507e
- SHA512
  
  c3936a1943575b0bb9dfdf8fef0d9705fc08c275260ce8199b7ff13213b72173565e7c1a4dfd47bd4a5a592ce10749ff1dafe73ba0053c9bd8f7a8cee495407d
- SSDEEP
  
  24576:WcvkT1s+3Z3aGWqKg0Ogj1OLHd+JwbMFdt6ATCRcaahwKHGaTKBupdl:hvkTq+3Z3ZWGsSHd+J+MFTsRcXnHGmKm
Score

10^/10

quasar venomrat office04 evasion rat rootkit spyware stealer trojan
- Contains code to disable Windows Defender
  A .NET executable tasked with disabling Windows Defender capabilities such as realtime monitoring, blocking at first seen, etc.
- Modifies Windows Defender Real-time Protection settings
  evasion trojan
- Quasar RAT
  Quasar is an open source Remote Access Tool.
  trojan spyware quasar
- Quasar payload
- VenomRAT
  VenomRAT is a modified version of QuasarRAT with some added features, such as rootkit and stealer capabilites.
  rat rootkit stealer venomrat
- Executes dropped EXE
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Deletes itself
- Loads dropped DLL
- Windows security modification
  evasion trojan
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
behavioral1 behavioral2