UAC-0020__2018__VERMIN_Quasar_RAT_and_Custom_Malware_Used_In_Ukraine.pdf

VERMIN:Quasar RAT and Custom Malware Used In Ukraine analyzes a new VERMIN malware family written in .NET, alongside Quasar RAT, linked to a Ukrainian-targeted campaign dating back to 2015. The report details malware behavior (decoy documents, ConfuserEx obfuscation, embedded keylogger, SOAP-based C2, scheduled task persistence), capabilities (collection of host data, keystrokes, clipboard), and a network of C2 infrastructure with multiple IOCs; it also provides sample hashes and appendix data for defenders.