Extracted

• • Target

    dbdca8a3ffa33284e03a1a7bd57e12ad_JaffaCakes118

  • Size

    709KB

  • MD5

    dbdca8a3ffa33284e03a1a7bd57e12ad

  • SHA1

    facc92651a792c4c8abe606ca47424b4f042224b

  • SHA256

    f1f367c2bd3c1bc93a4c4a3081a3aa1072eb7a50d13927e3b5bc03c310248d3a

  • SHA512

    727cd27bfb0ffc7a9f76fd02417de92a34ef4a1ed341953b1f5c6f78f851c83d5de390d3168df89367196a3de25eb370be1c3867affc94ae6520dff22d36bd94

  • SSDEEP

    12288:UJr8tk+8yQiFDmBhfyW8vXAo+bcRkkOHia0crMIsTX:Wx+5QhfP5x7Nm

  Score

  10^/10

  quasarvenomratsvhostdiscoveryratrootkitspywarestealertrojan

  • Contains code to disable Windows Defender

    A .NET executable tasked with disabling Windows Defender capabilities such as realtime monitoring, blocking at first seen, etc.

  • Quasar RAT

    Quasar is an open source Remote Access Tool.

    trojanspywarequasar

  • Quasar payload

  • VenomRAT

    VenomRAT is a modified version of QuasarRAT with some added features, such as rootkit and stealer capabilites.

    ratrootkitstealervenomrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Drops desktop.ini file(s)

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  behavioral1behavioral2