Extracted

• • Target
    (DxO PhotoLab Elite-x64) [18] - DxO PhotoLab Elite Multilingual/DxO PhotoLab Elite Multilingual/DxO PhotoLab 9.2.1.542 Installer.exe
  • Size 373.9MB
  • SHA256 285930cd7241e1ff2385ff6338e54468d0105254444fe542d637c24212b1e24b
  • MD5 ec1aa7c494693df80dd5c88f4328ec58
  • SHA1 3c08a7d2581b898240b45eab52da1f7f20882e8b
  • SHA512 d23207277bcdedff0b43d0278dafa6562ae05e08bc88eb21f0ccd3c1bee750118e57132180dbaea35922aa8fa3e5bece2af61622b2da473ceccc2fb9e04c132f
  • SSDEEP 6291456:KSZuGWLynRDWzcMxbse30+fZut7gLRyTJEcT8eJdmhfroVPclJUySs7xt1znbdv1:v0H8R69bse30+xpteE88eJ52lJVSG31f
  • TLSH
    T18B1933C5E2DCB1F3EC8FB0779F30A10191E0BC431B7E80BA56E5A891159E5F8B696742
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  afradiscoveryexecutionquasarpersistencespywaretrojanadwaredefense_evasionprivilege_escalationransomware

  • Family: Quasar RAT

    Quasar is an open source Remote Access Tool.

    trojanspywarequasar

  • Quasar payload

  • Badlisted process makes network request

    Network request originating from process or tool commonly abused by malware.

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Modifies Windows Firewall

    defense_evasion

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Drops file in System32 directory

  • Suspicious use of SetThreadContext

  behavioral1behavioral2
• • Target
    (DxO PhotoLab Elite-x64) [18] - DxO PhotoLab Elite Multilingual/DxO PhotoLab Elite Multilingual/dxo.photolab.elite.9.0.0.46.[x64]-MPT.exe
  • Size 208KB
  • SHA256 8cfa31dc653fbb385966914717630769f124347b32ce0c50b676ccd8727d9e57
  • MD5 b1163c2c1bee66fc429d2b37e830c9cf
  • SHA1 734d976a7bd989b49c3a4600c28dcdc9799538d5
  • SHA512 da5131c31d500e09eb6f919d3cd6aa537db52d14e1dd4947611f6a2cec91fe52366e4e872058f15d68febf17521ec532ab4db7bf0e90623c52ee42fa7e95ab81
  • SSDEEP 3072:6Mk+F7p5Upl14GUyEj67X6zzpIueJfv8oCtjxON7KMrKIzo4+poDVd7nuqQ++:6s7rU0/u7XYdIAjY9zo417y5
  • TLSH
    T1BA240143B7C8E992EE5092B09143EB7BD4148D87DC664743FA9AF93F6A7678B6C01430
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  7^/10

  discovery

  • Loads dropped DLL

  behavioral3behavioral4
• • Target
    (DxO PhotoLab Elite-x64) [18] - DxO PhotoLab Elite Multilingual/DxO PhotoLab Elite Multilingual/dxo.photolab.elite.9.0.0.46.[x64]-MPT_1.exe
  • Size 208KB
  • SHA256 8cfa31dc653fbb385966914717630769f124347b32ce0c50b676ccd8727d9e57
  • MD5 b1163c2c1bee66fc429d2b37e830c9cf
  • SHA1 734d976a7bd989b49c3a4600c28dcdc9799538d5
  • SHA512 da5131c31d500e09eb6f919d3cd6aa537db52d14e1dd4947611f6a2cec91fe52366e4e872058f15d68febf17521ec532ab4db7bf0e90623c52ee42fa7e95ab81
  • SSDEEP 3072:6Mk+F7p5Upl14GUyEj67X6zzpIueJfv8oCtjxON7KMrKIzo4+poDVd7nuqQ++:6s7rU0/u7XYdIAjY9zo417y5
  • TLSH
    T1BA240143B7C8E992EE5092B09143EB7BD4148D87DC664743FA9AF93F6A7678B6C01430
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  8^/10

  discoveryadwarepersistenceransomwarespyware

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Loads dropped DLL

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  behavioral5behavioral6