Overview

overview

10

Static

static

10

WINDOWS SE...XE.exe

windows7-x64

10

WINDOWS SE...XE.exe

windows10-2004-x64

Sharing

Copy URL
Twitter E-mail

General

  • Target

    WINDOWS SECURITY.EXE.exe

  • Size

    534KB

  • Sample

    240613-b89cpszenc

  • MD5

    9e14775490cee79c73cb45c2f24f7a73

  • SHA1

    ddd6c7485a5e64a66a0a7598777abdafa7a63950

  • SHA256

    d53df5b6b080ba24773ca16c7a8b70eeb783ead278712e0c5b44abc84805e60e

  • SHA512

    1c0aec61a64400bcf18f6f0e5a950c68b7a25492b07290e3793a759f616c1b361ed6472d260d0f379b691567216a1f9e53af53b2dc89711df618a4463c8d0317

  • SSDEEP

    12288:ijxIhDXIsMzz2ze1gejMd3mD88i2i3PdjfAag06:i9+IsM55O3glgPO

Score
10/10
quasarvenomratwindows securityratrootkitspywarestealertrojan

Malware Config

Extracted

Family

quasar

Version

2.1.0.0

Botnet

windows security

C2

quasarrat220-24487.portmap.io:24487

Mutex

VNM_MUTEX_mOPqShedZxvAqgLrWL

Attributes
  • encryption_key

    7mvA2TfKjvMIY0zZeMKF

  • install_name

    Client.exe

  • log_directory

    Logs

  • reconnect_delay

    3000

  • startup_key

    Venom Client Startup

  • subdirectory

    SubDir

Targets

    • Target

      WINDOWS SECURITY.EXE.exe

    • Size

      534KB

    • MD5

      9e14775490cee79c73cb45c2f24f7a73

    • SHA1

      ddd6c7485a5e64a66a0a7598777abdafa7a63950

    • SHA256

      d53df5b6b080ba24773ca16c7a8b70eeb783ead278712e0c5b44abc84805e60e

    • SHA512

      1c0aec61a64400bcf18f6f0e5a950c68b7a25492b07290e3793a759f616c1b361ed6472d260d0f379b691567216a1f9e53af53b2dc89711df618a4463c8d0317

    • SSDEEP

      12288:ijxIhDXIsMzz2ze1gejMd3mD88i2i3PdjfAag06:i9+IsM55O3glgPO

    Score
    10/10
    quasarvenomratwindows securityratrootkitspywarestealertrojan

    • Contains code to disable Windows Defender

      A .NET executable tasked with disabling Windows Defender capabilities such as realtime monitoring, blocking at first seen, etc.

    • Quasar RAT

      Quasar is an open source Remote Access Tool.

      trojanspywarequasar

    • Quasar payload

    • VenomRAT

      VenomRAT is a modified version of QuasarRAT with some added features, such as rootkit and stealer capabilites.

      ratrootkitstealervenomrat

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Scheduled Task/Job

1
T1053

Persistence

Scheduled Task/Job

1
T1053

Privilege Escalation

Scheduled Task/Job

1
T1053

Defense Evasion

Credential Access

Discovery

System Information Discovery

1
T1082

Remote System Discovery

1
T1018

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Tasks