Extracted

• • Target

    JaffaCakes118_f459a784ada721c739fdd0ffd39f0725

  • Size

    13.3MB

  • MD5

    f459a784ada721c739fdd0ffd39f0725

  • SHA1

    8e9dad10f064f4d7e831176e9082c7fd2ff38c0b

  • SHA256

    7a09042fcabbf4eb8d290df23a00b023fa10aadf329d599d7ff6ed5034621535

  • SHA512

    b481c57a94c1cd0bc3a2edf1aa5b1c1075051231e76298f0f75469722bdd34d28afce9327242b10b133276d5b24858a7691418a42d5e807bc965710d2c820c5a

  • SSDEEP

    49152:Kqsm55NYMPrb/T7vO90dL3BmAFd4A64nsfJlFngTR55I7NLz1:Kq95TUGP

  Score

  10^/10

  quasarcom surrogatediscoveryevasionspywaretrojan

  • Contains code to disable Windows Defender

    A .NET executable tasked with disabling Windows Defender capabilities such as realtime monitoring, blocking at first seen, etc.

  • Modifies Windows Defender Real-time Protection settings

    evasiontrojan

  • Quasar RAT

    Quasar is an open source Remote Access Tool.

    trojanspywarequasar

  • Quasar family

    quasar

  • Quasar payload

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Windows security modification

    evasiontrojan

  • Drops file in System32 directory

  behavioral1behavioral2