Extracted

Extracted

• • Target

    WindowsDefender.exe

  • Size

    205KB

  • MD5

    53cb889affead37778d2ef39092d91da

  • SHA1

    91820167c3b4065d07916adb0b56a867da1a68e9

  • SHA256

    946cc4d31bbc501fa25c2b22efc8e07cd0ea326b276333600f98c33689d407df

  • SHA512

    4cc5cbedf7a36a271e405bed1fb4beedde2c9e12e79e3100acd61b0160a9ad5f57c363457601104956f79327d7562944db8c4ae17e416fd27b0b6a39dd77d5c6

  • SSDEEP

    768:BLzayT8ljccym5fCja4sYxE7FWPA9pHOMhna4OE3QjFMtUiLi8PqXhP5++:BLzgAcJ5fzFJ9pHOM1ZOE3cMt/P85U+

  Score

  10^/10

  quasarxwormoffice04discoveryevasionpersistenceransomwareratspywaretrojan

  • Detect Xworm Payload

  • Modifies WinLogon for persistence

    persistence

  • Quasar RAT

    Quasar is an open source Remote Access Tool.

    trojanspywarequasar

  • Quasar family

    quasar

  • Quasar payload

  • UAC bypass

    evasiontrojan

  • Xworm

    Xworm is a remote access trojan written in C#.

    trojanratxworm

  • Xworm family

    xworm

  • Sets file to hidden

    Modifies file attributes to stop it showing in Explorer etc.

    evasion

  • Drops startup file

  • Executes dropped EXE

  • Modifies file permissions

    discovery

  • Modifies system executable filetype association

    persistence

  • Adds Run key to start application

    persistence

  • Checks whether UAC is enabled

    evasiontrojan

  • Modifies WinLogon

    persistence

  • Drops file in System32 directory

  • Sets desktop wallpaper using registry

    ransomware
  behavioral1