C:\Users\GO2!\R.A.T. 2020\R.A.T Source 5 NUCLEAR RAT - Version 4 - F4 Julio 2022 Puerto 9058\Client\obj\x86\Debug\Client.pdb
General
-
Target
cfd7fa8f2578198fa2aab263ae3087774a557a065f3e36c0a05be900a062b221.exe
-
Size
331KB
-
MD5
25e4b3153f2e61b139aaa9df1b2f8b12
-
SHA1
23c38b69b037670cafd48cf285cf88f41c7c854c
-
SHA256
cfd7fa8f2578198fa2aab263ae3087774a557a065f3e36c0a05be900a062b221
-
SHA512
b0c7090f25d63e7277e25d396db6636135a72c863f98bf24b23ab16ed547c593cf4ed19c6ebd969395cee205741ca7d5f9dffbe3ed770cbad016f33cb2f9d46e
-
SSDEEP
6144:FQAEfkGPHFi1zron6+s78g8mTXJgQ8EZbST8FQeLg5tIk:6/Fi1zro6+swHOEx8FQeLSq
Score
10/10
Malware Config
Signatures
-
Contains code to disable Windows Defender 1 IoCs
A .NET executable tasked with disabling Windows Defender capabilities such as realtime monitoring, blocking at first seen, etc.
-
Quasar family
-
Quasar payload 1 IoCs
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
Files
-
cfd7fa8f2578198fa2aab263ae3087774a557a065f3e36c0a05be900a062b221.exe
f34d5f2d4577ed6d9ceec516c1f5a744
Headers
Imports
Sections