Extracted

• • Target
    mko2.js
  • Size 3.4MB
  • SHA256 2a2683fec863bb9f0e3bcdbffa669e639742b8ef657014bea44f16e846d2dcb6
  • MD5 cac8367a64a991737827938d79f06edb
  • SHA1 f5eb29119708eae7d3bbb76a1feafbd5e3daf0d1
  • SHA512 8b8cf74600635a9c6a91a6687f02ca4e0d5f8e9bacc56e5b807e6261ed3dfe13f757e6ab6c49dcc9db1dc2f3e926a9d4c76ce438c265a294dc529eb8a44fbac1
  • SSDEEP 24576:vHEVMk5T3osvFujPiK6gnLeANeFbLS11qi3qQtub5cuBHjuyG0Wmdh0dvZP8v+z2:2
  • TLSH
    T1E7F54C39E8517C51A6FEC12FE7D6E4A82531BF518A879DC800BC53A21AE35D0FD9680F
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  mu88t2.orgdefense_evasionexecutionquasarpersistencespywaretrojan

  • Family: Quasar RAT

    Quasar is an open source Remote Access Tool.

    trojanspywarequasar

  • Quasar payload

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Sets file to hidden

    Modifies file attributes to stop it showing in Explorer etc.

    defense_evasion

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Prevents Microsoft Defender from scanning certain paths by adding an exclusion.

    Uses the Powershell Add-MpPreference cmdlet to exclude paths from being scanned by Microsoft Defender.

    defense_evasion

  • Adds Run key to start application

    persistence

  • Executes a VBScript file via the Windows Script Host.

    execution
  behavioral1behavioral2