Extracted

• • Target

    fpsFIX.exe

  • Size

    534KB

  • MD5

    68e20c59e6398f9fe522cc509d440698

  • SHA1

    5259db943f684f654c66ca277b28c410877494ad

  • SHA256

    6542a4adb925c38ae9fd6ddd0d5f838ac60b90e2db1e71ed71916fd6a988feb6

  • SHA512

    c25860340c9fd2b60a61490837febbe87d7912487cf6fbed0d31bd943c561767302be89c0309bc6e19df391e25adff5c4f6186a1b7f7fd181732c95da9a1ad09

  • SSDEEP

    6144:N8fGtiZAjx7ZgCUODKULTMMkbKGofLPRU9BZIbHtZLLLK1hI8MjXOZ3y7z2Qnp3Q:yexVgCUU5/MMdKB0Z/G1hyW3ApRa

  Score

  10^/10

  quasarvenomratoffice04evasionratrootkitspywarestealertrojan

  • Contains code to disable Windows Defender

    A .NET executable tasked with disabling Windows Defender capabilities such as realtime monitoring, blocking at first seen, etc.

  • Modifies Windows Defender Real-time Protection settings

    evasiontrojan

  • Quasar RAT

    Quasar is an open source Remote Access Tool.

    trojanspywarequasar

  • Quasar payload

  • VenomRAT

    VenomRAT is a modified version of QuasarRAT with some added features, such as rootkit and stealer capabilites.

    ratrootkitstealervenomrat

  • Executes dropped EXE

  • Windows security modification

    evasiontrojan

  • Legitimate hosting services abused for malware hosting/C2

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Drops file in System32 directory

  behavioral1