Extracted

• • Target

    a6750a74736787e997cea380247a97f2_JaffaCakes118

  • Size

    485KB

  • MD5

    a6750a74736787e997cea380247a97f2

  • SHA1

    7d25daa8359e023f8bb3bdb4c4fa77c2eeb19195

  • SHA256

    54e33e90fc6174e079fbb5d00abd7f3d2c8ad9bcc8c67910f3c21e4f31282aa0

  • SHA512

    6d029e775fb53e086c4f97a4594c919c976a49a58ecd1495d7c007206c3ef01a7b4c650a792734b17ee291c68bb96bd1175d9d40e3c1226318bc8bffc7185b23

  • SSDEEP

    12288:DVm5YyKReiCZp4o2ylxSyx9F7TPeBfoZ/mi:J8Yeimeyrr1elos

  Score

  10^/10

  quasarvenomratsvhostratrootkitspywarestealertrojan

  • Contains code to disable Windows Defender

    A .NET executable tasked with disabling Windows Defender capabilities such as realtime monitoring, blocking at first seen, etc.

  • Quasar RAT

    Quasar is an open source Remote Access Tool.

    trojanspywarequasar

  • Quasar payload

  • VenomRAT

    VenomRAT is a modified version of QuasarRAT with some added features, such as rootkit and stealer capabilites.

    ratrootkitstealervenomrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Drops desktop.ini file(s)

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  behavioral1behavioral2