Extracted

• • Target

    1b37a296595a5ec34d72b2d833116cad9869d9b6cd795117c16f75a8eeffb746

  • Size

    1.3MB

  • MD5

    3522dc4a208a91f7042864ce15bc1398

  • SHA1

    0d29e13a249fa713570418d5e1b306e59f4c7ea5

  • SHA256

    1b37a296595a5ec34d72b2d833116cad9869d9b6cd795117c16f75a8eeffb746

  • SHA512

    a2559e23bdf8791bd570842e70836319978214944c62065dc8ef67125ccd12ee37d9a82939fc8c62b8ec2913c993e0abf231c5f7e539e5bf2df6501ec4d99602

  Score

  10^/10

  persistencequasar za za za za za zaza za za za za zaspywaresuricatatrojan

  • Quasar Payload

  • Quasar RAT

    Quasar is an open source Remote Access Tool.

    trojanspywarequasar

  • suricata: ET MALWARE Common RAT Connectivity Check Observed

    suricata: ET MALWARE Common RAT Connectivity Check Observed

    suricata

  • Executes dropped EXE

  • Drops startup file

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2