Extracted

Extracted

• • Target
    DCPPP.js
  • Size 72KB
  • SHA256 97f3ddd69b71aa23045c4958562a30268747199c804ea26729a4dd8e87fabcba
  • MD5 d02258c71d65a74d87fee569d89b2096
  • SHA1 cb1e6b92b53b0396bbf8fef410d8b470a5d026e2
  • SHA512 cfa4d9869e16d436f3705f818a5d8ab32fd8dcf4e39d1517ff9ab148693190f99afe9e1dc931870ea4304911ce3084337afd80f01c20621a31e7e19e3734ee01
  • SSDEEP 1536:pkTjZkTBlkTQkTlkTQkTjkTlkTtkTlkTlkTjkTlkT/kTjkTlkTGkTjkTBlkTekT7:pkRkHkkkhkkknkhk5khkhknkhkLknkhi
  • TLSH
    T1D873357B1C82DFD90789C429260B5ECAD5173FA3DBC2C76524863B12E11D8CE5C7BA68
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  boradiscoveryexecutionquasarpersistenceprivilege_escalationspywaretrojan

  • Family: Quasar RAT

    Quasar is an open source Remote Access Tool.

    trojanspywarequasar

  • Process spawned unexpected child process

    This typically indicates the parent process was compromised via an exploit or macro.

  • Quasar payload

  • Badlisted process makes network request

    Network request originating from process or tool commonly abused by malware.

  • Command and Scripting Interpreter: PowerShell

    Run Powershell and hide display window.

    execution

  • .NET Reactor proctector

    Detects an executable protected by an unregistered version of Eziriz's .NET Reactor.

  • Creates a file in the Startup directory

    A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.

    persistenceprivilege_escalation

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

    discovery

  • Suspicious use of SetThreadContext

  behavioral1behavioral2