Extracted

Extracted

• • Target

    fart-with-extra-reverb.mp3

  • Size

    121KB

  • MD5

    56a2f872e5106165bb09f2952c467114

  • SHA1

    a492b74ceb9f5fc5cf4ff26ec96d063bbcb58230

  • SHA256

    b74577a99903aeadc8f89af84b81374e9e1a25562861cf4aff2d8a211cbe68db

  • SHA512

    5deadc5b63296e9224dd7a72b4220f5b47917fb4a31f97863308f78fa9f7f373aebf07850c81e3632de9c5b040cd9c014851e8a978ef44d1df7ec34f7975955f

  • SSDEEP

    3072:2TfH2lqavCLMpbhmO1FBBU4YJjq4ht+lSCtTaAoUAX4:eH2lq/Qbhm6jYJjq43fCtTaAon4

  Score

  10^/10

  nanocorequasarhhnot a rat lolloolooldefense_evasiondiscoverykeyloggerspywarestealertrojanexecution

  • NanoCore

    NanoCore is a remote access tool (RAT) with a variety of capabilities.

    keyloggertrojanstealerspywarenanocore

  • Nanocore family

    nanocore

  • Quasar RAT

    Quasar is an open source Remote Access Tool.

    trojanspywarequasar

  • Quasar family

    quasar

  • Quasar payload

  • Blocklisted process makes network request

  • Command and Scripting Interpreter: PowerShell

    Powershell Invoke Web Request.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Checks whether UAC is enabled

    defense_evasiontrojan

  • Drops desktop.ini file(s)

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  • Legitimate hosting services abused for malware hosting/C2

  behavioral1behavioral2