Extracted

• • Target

    sexy.exe

  • Size

    502KB

  • MD5

    0e28531b24a9dea26005a84d0f9dfa94

  • SHA1

    a749c6ab791a98fa17cc7251c37cf41ed2ca4277

  • SHA256

    15a42865e3b9563b0162987d9ba85a18fe6f7befb28d39daed3277434347200f

  • SHA512

    13d7596d08742b8425d461e38b007366c5ed3a9fe4b691e4b0bcc20548746a8813a3c1722f7e3ec08fbd7eb1916aa9fe436bf9c2179fe394d3663f406e83fc91

  Score

  10^/10

  quasarpdspywaresuricatatrojan

  • Quasar RAT

    Quasar is an open source Remote Access Tool.

    trojanspywarequasar

  • Quasar payload

  • suricata: ET MALWARE Generic AsyncRAT Style SSL Cert

    suricata: ET MALWARE Generic AsyncRAT Style SSL Cert

    suricata

  • suricata: ET MALWARE Observed Malicious SSL Cert (Quasar CnC)

    suricata: ET MALWARE Observed Malicious SSL Cert (Quasar CnC)

    suricata

  • Executes dropped EXE

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  behavioral1behavioral2