Extracted

Extracted

• • Target

    VerifiedAssetLinked.exe

  • Size

    3.2MB

  • MD5

    e8ecf83250f2badd7aa0c240fdc7be04

  • SHA1

    23081fbff25cb90abfaa3f6c80d3ae79dbaf6fdb

  • SHA256

    adb07f246886c9b3923cb565463a66cc3e69f16982dd513669d09b5285ac5cfa

  • SHA512

    aeebeb2f787303a8ea5594fd94e7c8002b8dd9eb6dd01bea001a6540c96954359d8fc2e4a596108256d197ef06bebca367900e388882e17ab134c2e8ec595140

  • SSDEEP

    49152:uXMWUmXsmnc6gB5LCeVYc5qwKQaUW6KfR3kVmqEze6ylTfKb8ExP0abZAGU3uXfp:kzTc6gBFi6aL7i1serlrK10EpU3uW

  Score

  10^/10

  quasarxwormoffice04defense_evasiondiscoveryratspywaretrojan

  • Detect Xworm Payload

  • Quasar RAT

    Quasar is an open source Remote Access Tool.

    trojanspywarequasar

  • Quasar family

    quasar

  • Quasar payload

  • Xworm

    Xworm is a remote access trojan written in C#.

    trojanratxworm

  • Xworm family

    xworm

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Obfuscated Files or Information: Command Obfuscation

    Adversaries may obfuscate content during command execution to impede detection.

    defense_evasion

  • Drops file in System32 directory

  behavioral1behavioral2