Extracted

• • Target
    sOhph5kJoUBra
  • Size 8KB
  • SHA256 9a8eddd821769ad9965b71e8f0331aef1e38a2a719580f2bd712e96842594512
  • MD5 b25e5ae1e0dc54d18429cd8b7a6212e4
  • SHA1 d986323f08b3e04aba838d8eca3c011147cac6b6
  • SHA512 515c5232012f4078ff22f7b969dbefdc3042cebc74ef21e61985aebc21af8d6a140f0c54c9159cd7fd308b2e41fc9006c2db970bcba32ba85934dd4da501f429
  • SSDEEP 192:pttNh8SJydZD2S/tRgaHORYyeXkcCTB7HwnB:3qSJyPD2S/fgaHDU5FHc
  • TLSH
    T1C102D628B8963870C56FD2BBF6689C3D963752F64CC716AC0268D3851B4732AAF91C44
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defense_evasiondiscoveryexecutiondonutloaderquasarloaderpersistencespywaretrojan

  • Detects DonutLoader

    loader

  • Family: DonutLoader

    DonutLoader is a position-independent code that enables in-memory execution of VBScript, JScript, EXE, DLL files and dotNET assemblies.

    loaderdonutloader

  • Family: Quasar RAT

    Quasar is an open source Remote Access Tool.

    trojanspywarequasar

  • Quasar payload

  • Badlisted process makes network request

    Network request originating from process or tool commonly abused by malware.

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Adds Run key to start application

    persistence

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

    discovery
  behavioral1behavioral2