Extracted

Extracted

• • Target

    0f9120aa260daa1849a56062f8b6a492_JaffaCakes118

  • Size

    488KB

  • MD5

    0f9120aa260daa1849a56062f8b6a492

  • SHA1

    a56e35f6cc5424936a56827d307253c56a937a0e

  • SHA256

    e2664640d1772b5f9626787ba8f6c88084c7a3de046457eeec2f0ce6bd07d215

  • SHA512

    ae52b328521f6a550951ac0c53745034f985230dcd850d0881079d1a2f50b865c30e646271dd4230f3d07db34bf6515b434bcf0f085f8e703533ae14180f81dc

  • SSDEEP

    12288:RhMM2P6wZMGWIHT0K5DDeOGYJeSyzLIB/xk5:Plk6SF9HT0gGie4B/x

  Score

  10^/10

  quasarspywaretrojanvenomratoffice04ratrootkitstealer

  • Contains code to disable Windows Defender

    A .NET executable tasked with disabling Windows Defender capabilities such as realtime monitoring, blocking at first seen, etc.

  • Quasar RAT

    Quasar is an open source Remote Access Tool.

    trojanspywarequasar

  • Quasar payload

  • VenomRAT

    VenomRAT is a modified version of QuasarRAT with some added features, such as rootkit and stealer capabilites.

    ratrootkitstealervenomrat

  • Executes dropped EXE

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  behavioral1behavioral2