Extracted

Extracted

• • Target
    8db0cd1d0244de2a22f748c4d8fdac91f6850f1fef19bc7f2afe1d5cefb5b228
  • Size 4.6MB
  • SHA256 8db0cd1d0244de2a22f748c4d8fdac91f6850f1fef19bc7f2afe1d5cefb5b228
  • MD5 2edf3837ac893184f93fde143bd0af95
  • SHA1 814f203372a478d17a4b49f990d5468f83faf5c6
  • SHA512 d9edebe51b82fc2b2d2ed860b2435a3d432da58623d8c2e4586cf7619285f82808d3c2394c327cfae66581a40862510d782c4c7ec2338a8f5674cb1531cd994b
  • SSDEEP 98304:+i7vEfqr7w3Kgf7XnWD09Yb8s3GFNEU3bbbkSJvp7M8NK8:+i7Dfw3DbWD09YAKGFjRJv9N
  • TLSH
    T18A263310F626E69ADAC08A3B9CF626C9411B3D3DCB90F5E548DC01F5E1D2953BA81DF8
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defense_evasiondiscoveryexecutionquasarxmrigxwormminerpersistenceratspywaretrojanupx

  • Detect Xworm Payload

  • Family: Quasar RAT

    Quasar is an open source Remote Access Tool.

    trojanspywarequasar

  • Family: Xworm

    Xworm is a remote access trojan written in C#.

    trojanratxworm

  • Family: xmrig

    XMRig is a high performance, open source, cross platform CPU/GPU miner.

    minerxmrig

  • Quasar payload

  • Suspicious use of NtCreateUserProcessOtherParentProcess

  • XMRig Miner payload

    miner

  • Command and Scripting Interpreter: PowerShell

    Using powershell.exe command.

    execution

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Checks BIOS information in registry

    BIOS information is often read in order to detect sandboxing environments.

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Creates new service(s)

    persistenceexecution

  • Executes dropped EXE

  • Stops running service(s)

    defense_evasionexecution

  • Adds Run key to start application

    persistence

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Power Settings

    powercfg controls all configurable power system settings on a Windows system and can be abused to prevent an infected host from locking or shutting down.

    persistence

  • Drops file in System32 directory

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  • Suspicious use of SetThreadContext

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2