Extracted

Extracted

• • Target
    DCPPP.js
  • Size 99KB
  • SHA256 cee5fde2df1863ef75239e3b45a603f947b4145969a16518867cd7037a0cb235
  • MD5 8299d7481dae709dda3257de991e5dad
  • SHA1 36a5716c87469dbdc77d5719e15a0d04b3416591
  • SHA512 cd9e2ad64a8f1e3c5324ac0ef8300dfee17ae9c179f08874dac479bee1de3f2b6a27cc755540da446d7ad690c2b36be80a6ca8a9d7f1cd20f475e972989fe3c8
  • SSDEEP 3072:mo8dYdeYwYYeYyeYze87YvSYbo8nY+wY4e87Y+sYDYYeYUTYZo8HYyTYtu87Y+wo:G
  • TLSH
    T1FFA35FAE0544DEB1CA99802C6A054EE99246FB078FD5EBD4B7CE3AAD210F1CD14FF614
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  boradiscoveryexecutionquasarpersistenceprivilege_escalationspywaretrojan

  • Family: Quasar RAT

    Quasar is an open source Remote Access Tool.

    trojanspywarequasar

  • Process spawned unexpected child process

    This typically indicates the parent process was compromised via an exploit or macro.

  • Quasar payload

  • Badlisted process makes network request

    Network request originating from process or tool commonly abused by malware.

  • Command and Scripting Interpreter: PowerShell

    Run Powershell and hide display window.

    execution

  • .NET Reactor proctector

    Detects an executable protected by an unregistered version of Eziriz's .NET Reactor.

  • Creates a file in the Startup directory

    A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.

    persistenceprivilege_escalation

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

    discovery

  • Suspicious use of SetThreadContext

  behavioral1behavioral2