Extracted

• • Target
    yeah-bro_encryptix.exe
  • Size 1014KB
  • SHA256 ef8cc8003803af2eba675a65f6a322ec876de2b274a1a72b800ed8edc5752815
  • MD5 422376afeb9fe547063cec956d273196
  • SHA1 8718f14c76237a4e173ba901914b1c3393b6fa51
  • SHA512 6f355ed280b16eb0871d1de337d5c035e0591c3b4dce8530bbcae2dc9f38c50ab1754520fa3a8a228d6d916095afcc135c6bda83717911e83cfe3cb1529b82c6
  • SSDEEP 24576:LuGdNsQvJnkIfZBrGg2IpTHmUeDMeFWVZMQocGPVkIRuv:L7y8xBrzRlHleIe0bHohPV7
  • TLSH
    T10725120B50C4B52EC66B243780835F94DBB7BAB32E0ED7B92172034D62694CFD647DA6
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  discoveryexecutionquasarpersistencespywaretrojan

  • Family: Quasar RAT

    Quasar is an open source Remote Access Tool.

    trojanspywarequasar

  • Quasar payload

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to get system information.

    execution

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Contacts third-party web service commonly abused for C2

    Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2