Extracted

• • Target

    320c9b7f61e1a20f89d2b4514d1545f0_JaffaCakes118

  • Size

    485KB

  • MD5

    320c9b7f61e1a20f89d2b4514d1545f0

  • SHA1

    36d91c66517c404317ddf5b596c4e5f841005c9c

  • SHA256

    735cbb15792d8be93c653fd2febafc249e57b29faa25aaafb99b42b310bca104

  • SHA512

    65d6d236b510f9cf0273b822c3cdad76afcdc5cb0f4c6dc9a2502eb5ea68238810dbe4c8ec332e36270984d77a1c1a7fe2c444c361f725f8a32ce040f990c276

  • SSDEEP

    12288:3dol1WDRTnx09/amkvj9LEuoJTtBhDSA3Lu7Yp8B4mi:Nmkd6/aTu5tfWAbuo8H

  Score

  10^/10

  quasarvenomratoffice04ratrootkitspywarestealertrojan

  • Contains code to disable Windows Defender

    A .NET executable tasked with disabling Windows Defender capabilities such as realtime monitoring, blocking at first seen, etc.

  • Quasar RAT

    Quasar is an open source Remote Access Tool.

    trojanspywarequasar

  • Quasar payload

  • VenomRAT

    VenomRAT is a modified version of QuasarRAT with some added features, such as rootkit and stealer capabilites.

    ratrootkitstealervenomrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Drops desktop.ini file(s)

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  behavioral1behavioral2