Extracted

• • Target

    DcRat.exe

  • Size

    15.6MB

  • MD5

    3c072e1234fdebc749eaad0921a0f890

  • SHA1

    0e1b63cc53414304bed9ab7331afcc8e695b4d90

  • SHA256

    733431ca3726f733f13a62b56f15faaef24c5edf1822deafee856fed28f31c44

  • SHA512

    474adfe31585930acb645c61e6f4feb511e59c4b7f3e094dc604ec5fdad74ff95db1aaa124991d4a0cd11f4306a2409a8520a0a4a7b68b85bc44512ebb04107e

  • SSDEEP

    196608:9j3DJU+Pp3IyrGM4fKotfZFB2gaNIsNNNNKmvN8rNNNNNNNNNNHbL7aIXM1B7Z0g:5DJ/p3ImmSmlT81Bd+3G6+

  Score

  10^/10

  quasarblitzedevasionspywarethemidatrojan

  • Quasar RAT

    Quasar is an open source Remote Access Tool.

    trojanspywarequasar

  • Quasar payload

  • Identifies VirtualBox via ACPI registry values (likely anti-VM)

    evasion

  • Checks BIOS information in registry

    BIOS information is often read in order to detect sandboxing environments.

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Themida packer

    Detects Themida, an advanced Windows software protection system.

    themida

  • Checks whether UAC is enabled

    evasiontrojan

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  behavioral1behavioral2