Extracted

Extracted

• • Target

    RDP Brute_Cracked.exe

  • Size

    1.7MB

  • MD5

    bd5cd7f77a38e709cb03b8b60cfcc15c

  • SHA1

    ed59b52ea4c63ffd6322bcb43155f2245048a541

  • SHA256

    4f66d0ced260b21359d60081d26c57bdeb3b54a293d084201589019d79379e8e

  • SHA512

    0f5973d3b16362cc2540065188bd3650be6622a8bf3b1bb6e310ec3f395292b916c0b1dd3514497a78efee847da16bf559eb21b3225d80ffb4ded4819a8a4b63

  • SSDEEP

    24576:Cj5yx6uJa4WiXV15W/F4A8A3GpF8EfE1FF1ehGXeRxm8F0EJSoUkgBbt:e59+WaV1J6GpFDEV1eEox10EPEbt

  Score

  10^/10

  quasarvenomratkgf5kgf6evasionpersistenceratrootkitspywarestealertrojan

  • Contains code to disable Windows Defender

    A .NET executable tasked with disabling Windows Defender capabilities such as realtime monitoring, blocking at first seen, etc.

  • Modifies Windows Defender Real-time Protection settings

    evasiontrojan

  • Quasar RAT

    Quasar is an open source Remote Access Tool.

    trojanspywarequasar

  • Quasar payload

  • VenomRAT

    VenomRAT is a modified version of QuasarRAT with some added features, such as rootkit and stealer capabilites.

    ratrootkitstealervenomrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Windows security modification

    evasiontrojan

  • Adds Run key to start application

    persistence

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2