Extracted

• • Target

    Oski Cracked.exe

  • Size

    4.7MB

  • MD5

    fae4c2fc795b054c80d57ad600f8447f

  • SHA1

    94ef84328a4c1c864307870d8e98cc4b6d334dd5

  • SHA256

    579e9d2e534610d36fa6073b825f8caffc41f1f20dad0cfd1749ca12d202a11c

  • SHA512

    35da6d3abc97cea70fb573d45f5bd528f5550d478a464f40dd1455f453c65a16283d3a5106aa9e488d3674db5d0ec7009a0cfd30d026afc4220e829f32075be9

  • SSDEEP

    98304:PahEJCbuSMburCaMZh0yEKj+WRvrY1dcZ048HV/bFy8jJ7LUdVmi:PahmmMbuQZlFY7KsZPNLUdQ

  Score

  10^/10

  oskiquasarvenomratwindows securityevasioninfostealerpersistenceratrootkitspywarestealertrojan

  • Contains code to disable Windows Defender

    A .NET executable tasked with disabling Windows Defender capabilities such as realtime monitoring, blocking at first seen, etc.

  • Modifies Windows Defender Real-time Protection settings

    evasiontrojan

  • Oski

    Oski is an infostealer targeting browser data, crypto wallets.

    infostealeroski

  • Quasar RAT

    Quasar is an open source Remote Access Tool.

    trojanspywarequasar

  • Quasar payload

  • VenomRAT

    VenomRAT is a modified version of QuasarRAT with some added features, such as rootkit and stealer capabilites.

    ratrootkitstealervenomrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Windows security modification

    evasiontrojan

  • Adds Run key to start application

    persistence

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1