Extracted

• • Target
    9ec3cecefe6abf353b8c6ba85dacd48afb8440c0855fb9060d7a5c6a832d6dc2
  • Size 1.4MB
  • SHA256 9ec3cecefe6abf353b8c6ba85dacd48afb8440c0855fb9060d7a5c6a832d6dc2
  • MD5 5c67f284077181eb5bd934df6b3d4f16
  • SHA1 a925b23ab7c17bea7107d23547922a343abe2f83
  • SHA512 ef0aa52fe0bef83bc28309fe1d95237a3313e4664d66c5b584182e857309eff9c2b82c24322d0c43f4b3fe3dddd9273bbc1829e5bc4669111d0f70862999ffbe
  • SSDEEP 24576:j/RtbHPROQVwih6dVWXM555EAT78vHmel4wt8u03lZ8NaLOYsMAbrJFi:j/DbekXMX8vHmel4IwlZ8IobrJQ
  • TLSH
    T12C653317320C43B7D0AA1330E217C7D9CB684DE887B61251B19AB1AC5DF6DA132F7AD2
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  discoverydonutloaderquasarloadermodulepersistenceprivilege_escalationratspywaretrojan

  • Detects DonutLoader

    loader

  • Family: DonutLoader

    DonutLoader is a position-independent code that enables in-memory execution of VBScript, JScript, EXE, DLL files and dotNET assemblies.

    loaderdonutloader

  • Family: Quasar RAT

    Quasar is an open source Remote Access Tool.

    trojanspywarequasar

  • PulsaRAT library module

    Core component of the PulsaRAT remote access trojan, implementing its command protocol for hidden remote desktop, UAC bypass, persistence, and credential theft.

    ratmodule

  • Quasar payload

  • Creates a file in the Startup directory

    A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.

    persistenceprivilege_escalation

  • Executes dropped EXE

  • Adds Run key to start application

    persistence

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  behavioral1behavioral2