Extracted

• • Target

    b75e201244597308d908a3464c0df0f99c27eb360c5851fcd0ca100c23115df4

  • Size

    927KB

  • MD5

    d9f78b702ec7fd8a246103fe2eae5704

  • SHA1

    90617fe3b2a7c71e6531eaa6b602c3ef86b3237d

  • SHA256

    b75e201244597308d908a3464c0df0f99c27eb360c5851fcd0ca100c23115df4

  • SHA512

    1be56e8d51aa911acf2159ab9c04ae98b3bd7ee5e28a295d20f23b6918bf005d2e45314ae01dccce404e93f7146dd7b2d5b1b4119674560eab52e3a23f2f8aad

  Score

  10^/10

  quasaroffice04evasionspywaretrojanmetastealerstealer

  • Meta Stealer Stealer

    Meta Stealer steals passwords stored in browsers, written in C++.

    stealermetastealer

  • Quasar Payload

  • Quasar RAT

    Quasar is an open source Remote Access Tool.

    trojanspywarequasar

  • Looks for VirtualBox Guest Additions in registry

    evasion

  • Executes dropped EXE

  • Looks for VMWare Tools registry key

    evasion

  • Checks BIOS information in registry

    BIOS information is often read in order to detect sandboxing environments.

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Loads dropped DLL

  • Maps connected drives based on registry

    Disk information is often read in order to detect sandboxing environments.

  • Drops file in System32 directory

  • Suspicious use of SetThreadContext

  behavioral1behavioral2