Extracted

• • Target

    Xidrf-gen.zip

  • Size

    63.2MB

  • MD5

    0266aa8ca1f0cfa75a5a16a1c57af296

  • SHA1

    60877a6ab03279b2afd77dfa0566fd9c0f605da7

  • SHA256

    c56b66a485a26d6a815e6fd6d5adb7abb6a2d1c001aae3a569a76b9ffa54b735

  • SHA512

    6911861ff514fbef9bf785cabff0ccc3b2b08e8feadfacdef0406938de422859ece1d9fa64f54e8ebe477726df688c304136722a62983a6a471c0edf74cb4f7e

  • SSDEEP

    1572864:BIGssbOjOvps4Sea/AU03s9SvL07pyMS1Cg:KN+ps4SeaYU03aSv9MS1Cg

  Score

  10^/10

  quasarvenomratxidrfdiscoveryratrootkitspywarestealertrojan

  • Contains code to disable Windows Defender

    A .NET executable tasked with disabling Windows Defender capabilities such as realtime monitoring, blocking at first seen, etc.

  • Quasar RAT

    Quasar is an open source Remote Access Tool.

    trojanspywarequasar

  • Quasar family

    quasar

  • Quasar payload

  • VenomRAT

    VenomRAT is a modified version of QuasarRAT with some added features, such as rootkit and stealer capabilites.

    ratrootkitstealervenomrat

  • Venomrat family

    venomrat

  • Executes dropped EXE

  • Loads dropped DLL

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  behavioral1behavioral2