Extracted

Extracted

Extracted

• • Target

    pack.com

  • Size

    500.1MB

  • MD5

    e893801ca83e49f84dca107d6e1162b4

  • SHA1

    3122871288ac44693324194b793fc40347360bd4

  • SHA256

    ca86561805b0e4184479159a552c05becbbad6f209b03df0819cbb0a47d75fe7

  • SHA512

    94f5ca28aedbc2e32383e10ed354a7e8d135f234dae6f1b6f2e1e6f703e4323ae1f3d0f5cb23d57aa85ebe319e59709429837666a7e96234bcabe6b4b851a719

  • SSDEEP

    384:ogPThofsksm2/HMLntRBSlwy/VpREaEhAqDjbY2QuzDf+m9xgJJt/V4568OwXpkD:tIXxOn6ZDn7d21448OKpkBC5ZF/i1

  Score

  10^/10

  purecrypterquasarrevengeratoffice04downloaderloaderpersistencespywaretrojan

  • PureCrypter

    PureCrypter is a .NET malware loader first seen in early 2021.

    loaderdownloaderpurecrypter

  • Quasar RAT

    Quasar is an open source Remote Access Tool.

    trojanspywarequasar

  • Quasar payload

  • RevengeRAT

    Remote-access trojan with a wide range of capabilities.

    trojanrevengerat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Adds Run key to start application

    persistence

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2