Extracted

Extracted

• • Target

    a500424ebd54b1e006ccad65266562e3_JaffaCakes118

  • Size

    303KB

  • MD5

    a500424ebd54b1e006ccad65266562e3

  • SHA1

    18be3591da1c3d79aee29026c30c67567e3b2bad

  • SHA256

    e4b0894af3fb7948dd92288339cf2fda627c26ec25b4d37c1620f6c005c0c01c

  • SHA512

    c197f02534c15b82f81def7d60349fba1e72c0b82d8b11fe64856a7ae7833e9d9d70d723bac8e1809ceda2cc9c76eb87025199230ba08ebc89bde2f6b71931ec

  • SSDEEP

    6144:7VPN+C5cB6NYR+perZTyhGupmUfr7MUYbW2KrFrg30RSsBWRzPDzWrkpeF4+:JPN+C5cB6pGTggGHUUrdgEAsotMk

  Score

  10^/10

  quasarvenomratoffice04ratrootkitspywarestealertrojan

  • Contains code to disable Windows Defender

    A .NET executable tasked with disabling Windows Defender capabilities such as realtime monitoring, blocking at first seen, etc.

  • Quasar RAT

    Quasar is an open source Remote Access Tool.

    trojanspywarequasar

  • Quasar payload

  • VenomRAT

    VenomRAT is a modified version of QuasarRAT with some added features, such as rootkit and stealer capabilites.

    ratrootkitstealervenomrat

  • Executes dropped EXE

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  behavioral1behavioral2