Extracted

Extracted

• • Target
    DCPPP.js
  • Size 80KB
  • SHA256 1f28fe4cee024027163b35495008288296f7da75ea4eab0e3c365703e37081a8
  • MD5 af39fe770ea03306854a36cd9fb0a393
  • SHA1 d79920dc5e0be61d0735c8f5796c4fc749ba0ef9
  • SHA512 a1eaf251f834d16420250da172ce7df6e787d03ea5087527a235cba2e8780d408505c4ca9f8c9a0168f82c69fc1885aec747ed61816d77092e859de6eb9b0dd6
  • SSDEEP 1536:LjbBXeXehXfXXhXNhXQhBXIXUtXojbBXcXBfX3hBXIXBjXgXXhX7wXijbBX8XNw4:bFfixeT8y
  • TLSH
    T1E4836CAB5B426F98876C60BA46434DCCDC3F3B425387C74579897F39B0CE98998AB434
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  boradiscoveryexecutionquasarpersistenceprivilege_escalationspywaretrojan

  • Family: Quasar RAT

    Quasar is an open source Remote Access Tool.

    trojanspywarequasar

  • Process spawned unexpected child process

    This typically indicates the parent process was compromised via an exploit or macro.

  • Quasar payload

  • Badlisted process makes network request

    Network request originating from process or tool commonly abused by malware.

  • Command and Scripting Interpreter: PowerShell

    Run Powershell and hide display window.

    execution

  • .NET Reactor proctector

    Detects an executable protected by an unregistered version of Eziriz's .NET Reactor.

  • Creates a file in the Startup directory

    A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.

    persistenceprivilege_escalation

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

    discovery

  • Suspicious use of SetThreadContext

  behavioral1behavioral2