quasar | 0abe5986a2df5b008585f4193803b32de17c045a605f7460ba23ec93012334c1

General

Target
soportedeconsignacionjpg.LHA
Size 793KB
Sample240808-wzcbts1bmd
SHA256 0abe5986a2df5b008585f4193803b32de17c045a605f7460ba23ec93012334c1
MD5 a9683ced4f24df7ff5b110cafb4bce9e
SHA1 b49e7b52f17433dde331bb1c584b0cf925fc0ce3
SHA512 7cc425384b174f53c0c7e8778a353d4fa35ed74d56ea50d8f9922d1835716bacffeeaedcc4e6adf205cd4ddceff1e978e365b78b59904d0583550ed5b8496c06
SSDEEP 24576:U0ZCyt57Vmkg4tjZxbKG2XgAW/ruRrUb0EpQB:9ZCqV6cjXbK/g5/ruRMpQB
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

Malware Config

Targets

- Target
  soportedeconsignacionjpg.LHA
- Size 793KB
- SHA256 0abe5986a2df5b008585f4193803b32de17c045a605f7460ba23ec93012334c1
- MD5 a9683ced4f24df7ff5b110cafb4bce9e
- SHA1 b49e7b52f17433dde331bb1c584b0cf925fc0ce3
- SHA512 7cc425384b174f53c0c7e8778a353d4fa35ed74d56ea50d8f9922d1835716bacffeeaedcc4e6adf205cd4ddceff1e978e365b78b59904d0583550ed5b8496c06
- SSDEEP 24576:U0ZCyt57Vmkg4tjZxbKG2XgAW/ruRrUb0EpQB:9ZCqV6cjXbK/g5/ruRMpQB
- MD5 SHA1 SHA512 SSDEEP
Score

1^/10
behavioral1 behavioral2
- Target
  soportedeconsignacionjpg.exe
- Size 844KB
- SHA256 3f4636a4b4101c14d44bf174c9b39c893c0500d7cf4642bab4306505d1bb1168
- MD5 1bff19378b84b40c9723443d87f400f7
- SHA1 dee51f5c440860c8e926bb255a788dffa6f53145
- SHA512 580780e1e5e66b2e08687f528e75daf0f674124ea436aca893a7e777d8544eb0b7954b7cc225ac9b247205e5671222e8c8d125fa93f65ea68204a3364f4aad50
- SSDEEP 24576:OfJhpWxQBr/TQwofMfud//O87q0mx1MqVI:OfZzbjeMMmt0mjMqVI
- MD5 SHA1 SHA512 SSDEEP
Score

10^/10

quasar defense_evasion discovery evasion execution impact persistence ransomware spyware trojan
- Contains code to disable Windows Defender
  A .NET executable tasked with disabling Windows Defender capabilities such as realtime monitoring, blocking at first seen, etc.
- Modifies Windows Defender Real-time Protection settings
  evasion trojan
- Modifies security service
  evasion
- Quasar RAT
  Quasar is an open source Remote Access Tool.
  trojan spyware quasar
- Quasar payload
- UAC bypass
  evasion trojan
- Windows security bypass
  evasion trojan
- Deletes shadow copies
  Ransomware often targets backup files to inhibit system recovery.
  ransomware defense_evasion impact execution
- Executes dropped EXE
- Loads dropped DLL
- Windows security modification
  evasion trojan
- Adds Run key to start application
  persistence
- Checks whether UAC is enabled
  evasion trojan
- Legitimate hosting services abused for malware hosting/C2
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
- Modifies Security services
  Modifies the startup behavior of a security service.
  defense_evasion
- Suspicious use of SetThreadContext
behavioral3 behavioral4