Extracted

• • Target

    305cfdd7d464938cabe66fcf3116df431c10742c775a4a588d38349ea18a7fb6.exe

  • Size

    763KB

  • MD5

    869037e716218fb7551d84b8ce7d0ae7

  • SHA1

    12cb776519eeb2d5e6a7ab1ddce3a09f143d5f18

  • SHA256

    305cfdd7d464938cabe66fcf3116df431c10742c775a4a588d38349ea18a7fb6

  • SHA512

    6840e10d1daeacd169dba4a0049bc3b9087726dd45551b9a9587d57ec45d926356ce1656a39fdf35c1acb4020c564ec1f6a910fd83cde99e3ff75195728c72d2

  • SSDEEP

    12288:SAZdPU5ttcsREhy5IYU8OaNISOvsk0gnT467zpmw7OfimWm/YfdFxfJ:S2UVc+EhyuAOaNIBXnT46fpmiOfimWy4

  Score

  10^/10

  purecrypterquasarrevengeratoffice04downloaderloaderpersistencespywaretrojan

  • Detect PureCrypter injector

    loader

  • PureCrypter

    PureCrypter is a .NET malware loader first seen in early 2021.

    loaderdownloaderpurecrypter

  • Quasar RAT

    Quasar is an open source Remote Access Tool.

    trojanspywarequasar

  • Quasar payload

  • RevengeRAT

    Remote-access trojan with a wide range of capabilities.

    trojanrevengerat

  • Downloads MZ/PE file

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2