Extracted

Extracted

• • Target

    XClient.rar

  • Size

    53KB

  • MD5

    e6f73d714362fabc16ba67f860fc6ada

  • SHA1

    1190df500df258f434bd6c8def231e210c9f45a6

  • SHA256

    22ae9f3838ce28bc03bcb7424f03e3f9a44b660d6647f035bd477bdbcc273900

  • SHA512

    a0fc6adeb8c054b8ed9a13a3d64c6a6901477b384facc5183fc2c1cd39128f53f12203e983d3204a1710aaa9e20031356ec50705482b0b0477479ba136c6a92b

  • SSDEEP

    768:SfiKlRdTOni46snvxCPVFgteS4QunUNo9MlReUydiEO9NKX4AYsBW9WaeA4dyNFe:KRTwhzcOtehQ9uWVyMdc4AY0/h8Sr

  Score

  10^/10

  quasarxwormhawk tuah spit on that thangdiscoveryexecutionratspywaretrojan

  • Detect Xworm Payload

  • Quasar RAT

    Quasar is an open source Remote Access Tool.

    trojanspywarequasar

  • Quasar family

    quasar

  • Quasar payload

  • Xworm

    Xworm is a remote access trojan written in C#.

    trojanratxworm

  • Xworm family

    xworm

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Executes dropped EXE

  • Legitimate hosting services abused for malware hosting/C2

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  behavioral1