Extracted

• • Target
    Venom28_Extracted/VenomRemote_Cracked.exe
  • Size 38.5MB
  • SHA256 0e59d8a36fc73b40178732c2e9dec9143ceb3dfd590547221dbce65983042141
  • MD5 83626a159e3399dc2bec680220ba8969
  • SHA1 c8fb91953976291310ddc645e2b9275277c57ec2
  • SHA512 6640d88a9aff7507d8372317e34422aa7a493d00194c945c2292d20445e0e0b6a0004ef90e8c263fe683b352292d89b28bdcb5fa4135be4333d4ef7076119f09
  • SSDEEP 393216:OFdlmXJTD1jJTDQMvfOjmM27kv1Bx0bQox/UlGkNCoIZZJTD2Mm1Zg6YH3mH1gfB:GLxMvDUjCbQa/O11t1Zg6kmH1gEEE
  • TLSH
    T17697F1273960F6C4F6BB19FC0370D62A83241E7A1A245931648876FD6DD1E96F18C3FA
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  7^/10

  agilenetdiscovery

  • Obfuscated with Agile.Net obfuscator

    Detects use of the Agile.Net commercial obfuscator, which is capable of entity renaming and control flow obfuscation.

    agilenet
  behavioral1behavioral2
• • Target
    Venom28_Extracted/client.bin
  • Size 908KB
  • SHA256 540fe401c160e29529b84083108666b3925126ae7681ba11325a6ef3b6613268
  • MD5 0333674e04906c427f81fe7470e93259
  • SHA1 13c6fe5d4016cf606f4fe962f2dedc20c9f3b987
  • SHA512 ee704065dd4289853505d0fb0a0645c949e98be2f93239d912172e5f9edbbb59198494d4581ae43cb9b37ee25fa4d00b65a29431465c9a799b2be5f589f9ad2c
  • SSDEEP 24576:FD7Y5PaGuEuICcGA60e4yETs5OK1lknB:57Y5PaGuEuICcGA60e4yEg1lk
  • TLSH
    T11415F914FBF455A1F0AE7F70747095054739BD0AA57DD64B2BAAA0881E6A3C0CCB1FA3
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  discoveryquasarspywaretrojanadwarepersistenceransomware

  • Family: Quasar RAT

    Quasar is an open source Remote Access Tool.

    trojanspywarequasar

  • Quasar payload

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  behavioral3behavioral4