Extracted

• • Target

    9b664d1737e4b08517167fff2d19bade

  • Size

    535KB

  • MD5

    9b664d1737e4b08517167fff2d19bade

  • SHA1

    dbbc1588618273813ca9f3de2708f4f4b7934029

  • SHA256

    ed07371994b2bce11a662df8ab5603ed80a73c30cdd4f29d922eae221320a39b

  • SHA512

    955e24ab139489a2835f553d6e58ebeb2af7dae20317c6510e3289a902bbf2a7ed329776dfc7afaa948d61fd0cd47b7216017003eaa410d4d07348e19848484c

  • SSDEEP

    12288:VuxMRH2MMvs5v5iX7K+k2dV++kQgog5Y:VWu2MMv5++kRc

  Score

  10^/10

  quasarvenomrathackedevasionratrootkitspywarestealertrojan

  • Contains code to disable Windows Defender

    A .NET executable tasked with disabling Windows Defender capabilities such as realtime monitoring, blocking at first seen, etc.

  • Modifies Windows Defender Real-time Protection settings

    evasiontrojan

  • Quasar RAT

    Quasar is an open source Remote Access Tool.

    trojanspywarequasar

  • Quasar payload

  • VenomRAT

    VenomRAT is a modified version of QuasarRAT with some added features, such as rootkit and stealer capabilites.

    ratrootkitstealervenomrat

  • Executes dropped EXE

  • Loads dropped DLL

  • Windows security modification

    evasiontrojan

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Drops file in System32 directory

  behavioral1behavioral2