Extracted

Extracted

• • Target
    DCPPP.js
  • Size 122KB
  • SHA256 f3db9fd0fab2f1c598413ec1dfa0654ce0581d98fe0cd42e0d4b904d93c6863c
  • MD5 6674e9425deeaba1a7a6fd8d0718fadf
  • SHA1 f8fb0e848f2aee486ac05d3d4d4bd04d54438bd5
  • SHA512 1a916988874f40d7faab93e06fc92d220fbe7b9c4a26bb904580fb7a849603d17a43a7ef66b3f8a769f9f2901878a3748d608392aeb3ac5d0b998d6e2910dc5b
  • SSDEEP 3072:QGiN2Nw2O22w2Mw2fwin2js2HGi72QO2Wwin2Qy2v22w2a/2RGib2M/2dAin2QOa:A
  • TLSH
    T10CC3C3763693EFCD0793C834252FABD99016AEA75BA6E7641441BA03EC1C8CD1C7ADD0
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  boradiscoveryexecutionquasarpersistenceprivilege_escalationspywaretrojan

  • Family: Quasar RAT

    Quasar is an open source Remote Access Tool.

    trojanspywarequasar

  • Process spawned unexpected child process

    This typically indicates the parent process was compromised via an exploit or macro.

  • Quasar payload

  • Badlisted process makes network request

    Network request originating from process or tool commonly abused by malware.

  • Command and Scripting Interpreter: PowerShell

    Run Powershell and hide display window.

    execution

  • .NET Reactor proctector

    Detects an executable protected by an unregistered version of Eziriz's .NET Reactor.

  • Creates a file in the Startup directory

    A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.

    persistenceprivilege_escalation

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

    discovery

  • Suspicious use of SetThreadContext

  behavioral1behavioral2