Extracted

• • Target
    x2c1baf1fcb28cae00906ea5336d816e5c201b3a176eb29833e0e1178dc690ff4.exe
  • Size 1.5MB
  • SHA256 2c1baf1fcb28cae00906ea5336d816e5c201b3a176eb29833e0e1178dc690ff4
  • MD5 d930dc581f9cb034a7930caee06f302c
  • SHA1 3212a62ab4de8a9f5233b9de517c302cc45019f9
  • SHA512 69ceefa9ad24e2e36b539de9ee3abeb5e0ff9c2e5debaf984f05f272f704a9fa32a22d7c5da963c76010daa04825ed1cd7acb92d4e7efd20068626ed7898c812
  • SSDEEP 24576:525kkKdcLt08/9urpRsOP98keuNNu1Hj3t+yZRrAXmDTKFTwQYQjvm7MuDEIeAgq:06xcx0yWLvPikhNY1Hj3t+yZRrAXmDTp
  • TLSH
    T12365F114D3F855B9E0B3A174DA628D03E7337C591772E68F47AC56A25F23284CE39B22
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  akpexecutionquasarvjw0rmpersistencespywaretrojanupxwormdefense_evasionevasion

  • Family: Quasar RAT

    Quasar is an open source Remote Access Tool.

    trojanspywarequasar

  • Family: Vjw0rm

    Vjw0rm is a remote access trojan written in JavaScript.

    trojanwormvjw0rm

  • Modifies Windows Defender DisableAntiSpyware settings

    evasiontrojan

  • Modifies Windows Defender Real-time Protection settings

    defense_evasiontrojan

  • Quasar payload

  • Windows security bypass

    defense_evasiontrojan

  • Badlisted process makes network request

    Network request originating from process or tool commonly abused by malware.

  • Downloads MZ/PE file

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Drops startup file

  • Executes dropped EXE

  • Adds Run key to start application

    persistence

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2