Extracted

• • Target

    Paypal cracker.exe

  • Size

    6.6MB

  • MD5

    5627dd16f023b8be51ed365d2fb6fee5

  • SHA1

    fcccce747bf6c824233cfda366798fa0467d3daf

  • SHA256

    2e2f6fe5b310d843656af43b60c0faddf6eb0f329efc8353272437db44b5f247

  • SHA512

    e475f903d2afd4c1b985f368f77610270df54bb8207130f6339e59595777718cfadadbb732775523a11aa035cbbf3c6d81896a33d84b40f6c01f182a1654f637

  • SSDEEP

    98304:xRlI+LjNr86mjj/UYviu26bbyKS2myX0rPpIh1KcV:xRlVmj72wblTmyEpG17V

  Score

  10^/10

  quasarvenomratwindows securitydiscoverypersistenceratrootkitspywarestealertrojan

  • Contains code to disable Windows Defender

    A .NET executable tasked with disabling Windows Defender capabilities such as realtime monitoring, blocking at first seen, etc.

  • Quasar RAT

    Quasar is an open source Remote Access Tool.

    trojanspywarequasar

  • Quasar family

    quasar

  • Quasar payload

  • VenomRAT

    VenomRAT is a modified version of QuasarRAT with some added features, such as rootkit and stealer capabilites.

    ratrootkitstealervenomrat

  • Venomrat family

    venomrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2

• • Target

    libeay32.dll

  • Size

    988KB

  • MD5

    177bda0c92482dfa2c162a3750932b9c

  • SHA1

    cb3b8a465fb55e9e0b4bb5a3298a481557a799d5

  • SHA256

    17a4b75ef43a4fdeedaef86c39bead6719144e3e368b55898b79ecb371012854

  • SHA512

    d6900cbcd53d2993ea639e70fe7d0b29595153c4ef54eb9c4a264c22963ca64d551dd633ce1c5d657bd371ddeebcff00419d50a13e423d44f25c8ac9f8ccf3d0

  • SSDEEP

    12288:baTkV9YfAjvnC+pcU0MfHJQXA7WpVn2UNKQbox5b6j6iHk:bOBcnJpcTMve5pV9sQbsejrHk

  Score

  3^/10

  discovery
  behavioral3behavioral4

• • Target

    libssl32.dll

  • Size

    242KB

  • MD5

    0fe22a92ca281ce90559b271c59720e0

  • SHA1

    ff15840b0e0915137b26bbd7cccf20842ce4f70c

  • SHA256

    697dbe0b9635f723568d0911d1c48a91c326f116f674003b26d5653ec157b4de

  • SHA512

    2f3394341134a93a9c9f29f09a8c9e28e9942c452f828db7c734631d4c01ca0088150d329e9e4f3e1d9f50fa68fbb91b45670c43dd26c82cc3e04a0ddd100d9c

  • SSDEEP

    3072:Bah7VLBox0RGusHgbCdFoccseuoejw6J2focByGhQQDuXtrxYpGwyzTjAOj:8pVFoDusAOA95ulJg8GctrxYpmvAOj

  Score

  3^/10

  discovery
  behavioral5behavioral6

• • Target

    msvcr71.dll

  • Size

    340KB

  • MD5

    5d70d744b237a3a1f57c475600764c3e

  • SHA1

    87bad3d29394b08459d164a6047657a3f9498f60

  • SHA256

    525b896a6de9d1c400a61d09cbd1248376f64559da5ef22380600efefdd06078

  • SHA512

    730e876de54596e5ef9e7e14a5eb74efd1661659ebb06c0be8ff7055d62103d5fedd11c07ccf1a2b958c46542cff580ce3a22d4d313cb8ed8b82e6ba6db3571a

  • SSDEEP

    6144:PcV9z83OtqxnEYmt3NEnvfF+Tbmbw6An8FMciFMNrb3YgxxpbCAOxO2ElvlE:Poz83OtIEzW+/m/AyF7bCrO/E

  Score

  3^/10

  discovery
  behavioral7behavioral8

• • Target

    ssleay32.dll

  • Size

    192KB

  • MD5

    5023f4c4aaaa1b6e9d992d6bbdcd340b

  • SHA1

    2165b4a8089a7c00dc586c983e8548653a4e0ce4

  • SHA256

    59b1be1072dd4aca5ddcf9b66d5df8bec327b4891925ba2339fe6ac6a1bf6d19

  • SHA512

    c2885d8a8daac7ff83991dd81c6b2993c874081ea8877511aedd61e31829b26d33d8d9e433c7c72dd79d4cdf5d2a6e484b980117549770df1d2f2f522f8a0758

  • SSDEEP

    3072:whsCnSceRcwwWbLhF8KzwtF1TKXpE2y5jfFKRz+AAWeZJHR7u9Ea3Q0du1f:5TRVwWblFrzw31TKRatKVjqJHW3/d

  Score

  3^/10

  discovery
  behavioral10behavioral9