Extracted

Extracted

• • Target
    rfdnmghdfngdf.exe
  • Size 25.3MB
  • SHA256 4077650d26e922bd7751ad46759b96612bde298e66fbb6235dd08da9280d2370
  • MD5 0eae56941c4b9537b0bbc914e1b191c0
  • SHA1 e475d9af4325d727128365700e24b2d91392c7d6
  • SHA512 c2e996f0610d3fe2cee2304e6f13f75fa34a3889b0c19481b6249a318b79f0e8643027068e09e82e11d8db354e0477ab4c58a573db7318bab1637caaafb3c831
  • SSDEEP 786432:mNcRQoGY8e+WWSc+uPihPr+WilDeW0o2NezikK:EcDUbSctipixeW0ohikK
  • TLSH
    T1B24733C0AD4EA6B6E866F8F3A05051007619DBA9B0DCDD7B5F89478CC884D18E83793B
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  cs2defense_evasiondiscoverydownloaderexecutioncustomerloaderquasarxwormloaderpersistenceratspywaretrojan

  • Customer Loader

    Customer Loader is a downloader written in C#.

    downloaderloadercustomerloader

  • Customerloader family

    customerloader

  • Detect Xworm Payload

  • Quasar RAT

    Quasar is an open source Remote Access Tool.

    trojanspywarequasar

  • Quasar family

    quasar

  • Quasar payload

  • Xworm

    Xworm is a remote access trojan written in C#.

    trojanratxworm

  • Xworm family

    xworm

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Drops startup file

  • Executes dropped EXE

  • Loads dropped DLL

  • Uses the VBS compiler for execution

  • Adds Run key to start application

    persistence

  • Obfuscated Files or Information: Command Obfuscation

    Adversaries may obfuscate content during command execution to impede detection.

    defense_evasion

  • Suspicious use of SetThreadContext

  behavioral1behavioral2