Extracted

• • Target

    Spoofers/Cleaner.exe

  • Size

    7.5MB

  • MD5

    ba5b980e4d8a2229836b393860cc3b4c

  • SHA1

    b08af0140ef0e54fb99d077b08d97ec5c8ebd52f

  • SHA256

    89f481a8c2b2b29afbdb45e2bbe01b24346a118aa3775e6a7a28537a54a85e15

  • SHA512

    bff2841fb6d166abec6a1d3f9ab1fb777f3e1f912e47dea650e4119919310a10cf0399d3d23d4dc700890e327b5b2f8d99fa28c317fb11e56582e83b53a28a5a

  • SSDEEP

    196608:YGhhOourErvI9pWjg/Qc+4o673pNrabenyzWtPMYnNcs9:HburEUWjZZ4dDLIeyzWtPTNz9

  Score

  10^/10

  discoveryevasionexecutionupx

  • Deletes Windows Defender Definitions

    Uses mpcmdrun utility to delete all AV definitions.

    evasion

  • Command and Scripting Interpreter: PowerShell

    Using powershell.exe command.

    execution

  • Loads dropped DLL

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Enumerates processes with tasklist

    discovery

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1

• • Target

    Spoofers/PermWoofer.exe

  • Size

    3.1MB

  • MD5

    b4ac68d3c6cc89ae97e519b9a7241bba

  • SHA1

    ced8a4dec2238bc5f2b7ca9ef9fdac0a6cd9108f

  • SHA256

    03bc2c340a1081e1521a5c4b92c38756f4de234ac1b1a578556d83737972e343

  • SHA512

    8870741c08574945ea43055e6031394af96290348e4e55d3570f937020c49020fc7d61517d9ab9dd42fc65066ba113cb8a31f2d45cff7f7301f8e865d52aa1d5

  • SSDEEP

    49152:Kvkt62XlaSFNWPjljiFa2RoUYIibRJ60bR3LoGdjTHHB72eh2NT:Kv462XlaSFNWPjljiFXRoUYIibRJ6+

  Score

  10^/10

  quasaroffice04spywaretrojan

  • Quasar RAT

    Quasar is an open source Remote Access Tool.

    trojanspywarequasar

  • Quasar family

    quasar

  • Quasar payload

  • Executes dropped EXE

  behavioral2