Extracted

• • Target

    Release/Handlers/Handler.bat

  • Size

    12.7MB

  • MD5

    e154d92aa7ecd7728940f32bb2c82cc6

  • SHA1

    b004e191ae993b3deab2d77c6f99c64e5de55672

  • SHA256

    37be53a96145cd6ad7557e95d85a256377af9d9e126538a4733ebde178254cc5

  • SHA512

    b8b822fc4d8295a59700b7750fff7841f56ed877207e622dd7d7b0435ce737f212d5f754c95f2329b87e83c1ae796b07724276473256d8787f0f87b1871121e4

  • SSDEEP

    49152:Fh5PUtdFBcAJU7Ygqef4u6NE6BGzp3OtWxgusC7QG5r0Wn9O3oGpWJtPS1P8keqj:4

  Score

  10^/10

  defense_evasionquasarv2.2.5 | vanillaratdiscoveryspywaretrojan

  • Quasar RAT

    Quasar is an open source Remote Access Tool.

    trojanspywarequasar

  • Quasar payload

  • Suspicious use of NtCreateProcessExOtherParentProcess

  • Suspicious use of NtCreateUserProcessOtherParentProcess

  • Checks BIOS information in registry

    BIOS information is often read in order to detect sandboxing environments.

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself

  • Executes dropped EXE

  • Indicator Removal: Clear Windows Event Logs

    Clear Windows Event Logs to hide the activity of an intrusion.

    defense_evasion

  • Loads dropped DLL

  • Hide Artifacts: Hidden Window

    Windows that would typically be displayed when an application carries out an operation can be hidden.

    defense_evasion

  • Suspicious use of SetThreadContext

  behavioral1behavioral2behavioral3behavioral4

• • Target

    Release/VanillaRat.exe

  • Size

    1.7MB

  • MD5

    59fea74c326c7e496617bb45bdfbcc00

  • SHA1

    7c0dd54592857eed1cb068e24315b2bbe7511b76

  • SHA256

    9b6dcbe8df1be5241a40987a416e896737a7442db492e9df8413277835fb766d

  • SHA512

    443005543a476b0c3ef4744ba0b7075185cf0ae80783c06f98ee2845872c54ad2ee6d69810acaed692720b5ad19129935b751e45ac8725b050ccca5b94ecc6ba

  • SSDEEP

    24576:Lz2qwZHZd2PjnRh3Xz2DrtasSA7ZUNnbkAqE6joUZ57W:f2qw+nYVZY6jog

  Score

  10^/10

  executiondefense_evasionquasarv2.2.5 | vanillaratdiscoveryspywaretrojan

  • Quasar RAT

    Quasar is an open source Remote Access Tool.

    trojanspywarequasar

  • Quasar payload

  • Suspicious use of NtCreateProcessExOtherParentProcess

  • Suspicious use of NtCreateUserProcessOtherParentProcess

  • Command and Scripting Interpreter: PowerShell

    Run Powershell and hide display window.

    execution

  • Checks BIOS information in registry

    BIOS information is often read in order to detect sandboxing environments.

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Indicator Removal: Clear Windows Event Logs

    Clear Windows Event Logs to hide the activity of an intrusion.

    defense_evasion

  • Loads dropped DLL

  • Hide Artifacts: Hidden Window

    Windows that would typically be displayed when an application carries out an operation can be hidden.

    defense_evasion

  • Suspicious use of SetThreadContext

  behavioral5behavioral6behavioral7behavioral8