Extracted

• • Target
    darkmoon v2/lib/AyBYMBjlvU.bat
  • Size 12.6MB
  • SHA256 9d0b440b61b239bc3406d67bf7ae8baf1ceef65923e8558ce3a3c1a3c4a5e22a
  • MD5 8e3d8ed6db7cb979d5d56c8b847cc965
  • SHA1 5d1ad752a988ce13da601448cdca5584610cffee
  • SHA512 d7a96420b1e61c4bc7db6c533704771e329239629201dbf34ac8a95a931da92c6e1d7ddb694a491656246b0eb491e96d194b7abccf54ef757c1aea92a9b96a0e
  • SSDEEP 49152:Hq8mcjsXbvlusR48pNIN/I/EiFTPbYWLP17DFNkKuri3NSbkpXYyr7arOR150kFB:o
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  quasarv2.2.6 | seroxenspywaretrojan

  • Quasar RAT

    Quasar is an open source Remote Access Tool.

    trojanspywarequasar

  • Quasar payload

  • Suspicious use of NtCreateProcessExOtherParentProcess

  • Suspicious use of NtCreateUserProcessOtherParentProcess

  • Checks BIOS information in registry

    BIOS information is often read in order to detect sandboxing environments.

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Drops file in System32 directory

  • Suspicious use of SetThreadContext

  behavioral1behavioral2
• • Target
    darkmoon v2/lib/DarkMoon_Gen.exe
  • Size 340KB
  • SHA256 c147148fa809e238efc3e60b2ed129a93f11694b31d194f7347ddfbb6b82ba20
  • MD5 f3c021dbce0cd670f15415c3aa6b83aa
  • SHA1 433842e6529c6df685da1317bfd69d2ea0c85cca
  • SHA512 5690f12b45819cf28dfc350d3e362f172f1f589b9614b639f995e1bb56ea8fcb87b3058323998f33dd3637b48f00d596c63866cfde7172a3ac664fac110a6f66
  • SSDEEP 3072:eahKyd2n3175Ctbq6rw3VScvNSAh8CndDOMrt1nW:eahOql+UcsMra
  • MD5 SHA1 SHA512 SSDEEP

  Score

  6^/10

  persistence

  • Adds Run key to start application

    persistence

  • Legitimate hosting services abused for malware hosting/C2

  behavioral3
• • Target
    darkmoon v2/start.bat
  • Size 82B
  • SHA256 c07fbd6c49d83eb8399435f9972551d2c73a29e5914a25640639191d187dd80d
  • MD5 e6ede72374e4f7b8b907d4099c76f4d4
  • SHA1 146899cf959ada383b0a258b06da7963ef0d1c70
  • SHA512 1b2d0cd4a5deae331ed16f383831f4ff7ba1c5b7f6906a35354dfd420ca44f17e3469157f2327685a6aa9773175425aa145faa2d4866030d131334eb36426fcc
  • MD5 SHA1 SHA512

  Score

  10^/10

  persistencequasarv2.2.6 | seroxenspywaretrojan

  • Quasar RAT

    Quasar is an open source Remote Access Tool.

    trojanspywarequasar

  • Quasar payload

  • Suspicious use of NtCreateProcessExOtherParentProcess

  • Suspicious use of NtCreateUserProcessOtherParentProcess

  • Checks BIOS information in registry

    BIOS information is often read in order to detect sandboxing environments.

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • Legitimate hosting services abused for malware hosting/C2

  • Drops file in System32 directory

  • Suspicious use of SetThreadContext

  behavioral4behavioral5