Extracted

• • Target

    vcac.exe

  • Size

    24.2MB

  • MD5

    a4a742b543e52358357924c02b9490c4

  • SHA1

    6a8309fc0b3fc6b0747a2c5f89ef7a29428ba743

  • SHA256

    bfd525cf8e0cb81260ed6a80c666491b41b456f5ad389b62089346acbe90856b

  • SHA512

    fb32df097ff44c7be4549d851c8121e26c5fcd6400e8b1b095c2c38bd71214039f81be358e1e3d886a16fe92e83489ab72dacf99ef62768aca8c5aa5698010b4

  • SSDEEP

    98304:GKBbBWIgWljGxRB/LL6vc22SsaNYfdPBldt6+dBcjHVCU688cIyGOk3ta:L4xRBjgB7j4U6gl

  Score

  10^/10

  quasarbootkitdiscoveryevasionexploitpersistenceransomwarespywaretrojan

  • Quasar RAT

    Quasar is an open source Remote Access Tool.

    trojanspywarequasar

  • Quasar payload

  • Deletes shadow copies

    Ransomware often targets backup files to inhibit system recovery.

    ransomware

  • Disables Task Manager via registry modification

    evasion

  • Drops file in Drivers directory

  • Modifies Windows Firewall

    evasion

  • Possible privilege escalation attempt

    exploit

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Drops startup file

  • Executes dropped EXE

  • Loads dropped DLL

  • Modifies file permissions

    discovery

  • Adds Run key to start application

    persistence

  • Drops desktop.ini file(s)

  • Legitimate hosting services abused for malware hosting/C2

  • Writes to the Master Boot Record (MBR)

    Bootkits write to the MBR to gain persistence at a level below the operating system.

    bootkitpersistence

  • Drops file in System32 directory

  • Sets desktop wallpaper using registry

    ransomware
  behavioral1behavioral2