Extracted

• • Target

    1c1cd3ee6e73a4e599c7c32bae300b05_JaffaCakes118

  • Size

    12.8MB

  • MD5

    1c1cd3ee6e73a4e599c7c32bae300b05

  • SHA1

    dd22b9c9531efdecd80d37b01254e96728ef26c3

  • SHA256

    f1946c208e4a8f7428f97e8e40f31ffa95885b61571dc4ab9ba6a3356336fc12

  • SHA512

    484ab45694f4789a8f385dd6346c2711d8b79368760819065592163f763a8724c91993fbc0bfbf58ce0c1d0f7d9132f9b59a99645790e4e68ece6650b99cd037

  • SSDEEP

    393216:IY/d0T2My8oDotr3LItcM4epPOgmYQbml1ay:IYeqvE1Sd/WmSy

  Score

  10^/10

  quasarvenomratgreedensevasionratrootkitspywarestealerthemidatrojan

  • Contains code to disable Windows Defender

    A .NET executable tasked with disabling Windows Defender capabilities such as realtime monitoring, blocking at first seen, etc.

  • Modifies Windows Defender Real-time Protection settings

    evasiontrojan

  • Quasar RAT

    Quasar is an open source Remote Access Tool.

    trojanspywarequasar

  • Quasar payload

  • VenomRAT

    VenomRAT is a modified version of QuasarRAT with some added features, such as rootkit and stealer capabilites.

    ratrootkitstealervenomrat

  • Identifies VirtualBox via ACPI registry values (likely anti-VM)

    evasion

  • Checks BIOS information in registry

    BIOS information is often read in order to detect sandboxing environments.

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself

  • Executes dropped EXE

  • Loads dropped DLL

  • Themida packer

    Detects Themida, an advanced Windows software protection system.

    themida

  • Windows security modification

    evasiontrojan

  • Checks whether UAC is enabled

    evasiontrojan

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Drops file in System32 directory

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  behavioral1behavioral2