Extracted

• • Target
    WildForest.zip
  • Size 3.9MB
  • SHA256 640d9049b887f846824f51a547612de6553897f5c3e221c39f6a019b8bb6086a
  • MD5 13afd3e25b593dc83374c001349819c7
  • SHA1 c8b5e6f341386f67d4986fd8410afbdf65be6ad1
  • SHA512 4abc5e21eacbe70e77d686b3b26144ace065125dd8afe936872dc01184b12d7c787b3f93f8eee86a4c98a525bd9a80835933040e3688b7b14f712b2c1a0fa593
  • SSDEEP 98304:mT/G0C6pRJ1Rujsfqlb1Yv/45qp1IR+F6rZFzMX2Eqf:E/G0dbRnqlbGvQkp1sZWmEqf
  • TLSH
    T17F1633EBB95CDAE3E2290133419E1D3EE769842AFB48FC15D50BF09180B6F913BA4751
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defense_evasionexecutionquasarmodulepersistenceratspywaretrojan

  • Family: Quasar RAT

    Quasar is an open source Remote Access Tool.

    trojanspywarequasar

  • PulsaRAT library module

    Core component of the PulsaRAT remote access trojan, implementing its command protocol for hidden remote desktop, UAC bypass, persistence, and credential theft.

    ratmodule

  • Quasar payload

  • Sets file to hidden

    Modifies file attributes to stop it showing in Explorer etc.

    defense_evasion

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Adds Run key to start application

    persistence

  • Deobfuscate/Decode Files or Information

    Payload decoded via CertUtil.

    defense_evasion

  • Executes a VBScript file via the Windows Script Host.

    execution
  behavioral1behavioral2
• • Target
    D3D12/D3D12Core.dll
  • Size 4.5MB
  • SHA256 e680757d16e66756c21fb0603d12a1e47928cf7b2897f9e5c03af3a87b5c8b24
  • MD5 521ce26025a21ccd8fed71110702fd57
  • SHA1 654b0433d840aed8a4930928ad76384ba2171232
  • SHA512 247c83b781448404170d28f35c5c9d47a8da8e2e806b61e5a5e5ad705814543a9a0a02819ce1e81e858b79b35b9ec68f687be0701170c5a0884ff20580304150
  • SSDEEP 49152:7h38HT1tnrx7KGN6McyBTwbreXHYTNeZQROL+qgGVO9EflU7slMWr+IGrh4TeeYP:1MBxrfwNFrfau5e/
  • TLSH
    T1B2267C07BBA840E8D4A6C179CA6B461FE7B278654370E7CB169083995F73BE1193F324
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  1^/10
  behavioral3behavioral4
• • Target
    GameAssembly.dll
  • Size 236KB
  • SHA256 1796e9fadc4d204f1da661b493e502769df5575234e2b70bf232e867dba36545
  • MD5 94931ce39728d840c53c33b6193e104f
  • SHA1 d0bb1b4f9d5074262856f6f5ffcd28069fde288a
  • SHA512 a78d239c994d8aed94c4265bfc07cc87200aadb5f35505f0f24f9ee402338038c6cfc5b42f18723c831c98ced65f9b2cdb23ca79e957d349b3cf944ca4e8ef7c
  • SSDEEP 3072:nAek/vSCKqHgMPuplt90vtE5NNjsp7ZKlKrSibdYJl8Jx:nAeoPgMPi0vtQ12/SkYT8
  • TLSH
    T13E347D4972A40D66FD7741B4CD535A1AE6723C034740CACF43E483A5AE6BBD06A3FB62
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  1^/10
  behavioral5behavioral6
• • Target
    WildForest.installer.exe
  • Size 1.0MB
  • SHA256 d190887c4d0d3653a79252bd757fee12c2bcf50c4783ff4658af62f05487983c
  • MD5 577bed4ee8b08a9070fd4a9f82fafef1
  • SHA1 599f68ac1f94bcde469c68db2cf2f05898896037
  • SHA512 b0198ec5ec56a37941b025320fd6285a3b262e45662be13eefa13c165ff292d772e7b2b7b43521ca9193f9c0db3de1c23e73012bb0e5f559a5711287edbb8c0e
  • SSDEEP 12288:df9w4z2ktJxFSDdqm/qxFHEEjZ6+HWMpFmjpUaati1FKBs3g81CgglZkX7+IaagI:x9PFSZjALQ+tSml8i6g81Cggjmp4ybz
  • TLSH
    T199250293EE044CBEC3DB5C3583BF3B9946E054623E52DCB42B713C469EEAB8664051B9
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defense_evasionexecutionquasarmodulepersistenceratspywaretrojan

  • Family: Quasar RAT

    Quasar is an open source Remote Access Tool.

    trojanspywarequasar

  • PulsaRAT library module

    Core component of the PulsaRAT remote access trojan, implementing its command protocol for hidden remote desktop, UAC bypass, persistence, and credential theft.

    ratmodule

  • Quasar payload

  • Sets file to hidden

    Modifies file attributes to stop it showing in Explorer etc.

    defense_evasion

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Adds Run key to start application

    persistence

  • Deobfuscate/Decode Files or Information

    Payload decoded via CertUtil.

    defense_evasion

  • Executes a VBScript file via the Windows Script Host.

    execution
  behavioral7behavioral8