Extracted

Extracted

• • Target

    Trip Itinerary detail.vbs

  • Size

    245KB

  • MD5

    e011adb4a7b7e60d89697fd6060a5b83

  • SHA1

    6a7c2953cffe72cb5178d800be718bbadcf7f14b

  • SHA256

    b73dbf4a79bb87a8294bf87271ec249ed831ec72e6e194c3636f78858dcd3ab1

  • SHA512

    c6adbaf622441058d018258adbb2d1cda5b390c80234ea66b1fe9fd149b5adf28f7a8575d6159d25073fde93f712a86831968cf0a0ed710c495581042c275d00

  • SSDEEP

    3072:iC99Sy99y999999999996999999999999N9999SoV969ZA:Z

  Score

  10^/10

  quasarvenom clientpersistencespywaretrojan

  • Quasar RAT

    Quasar is an open source Remote Access Tool.

    trojanspywarequasar

  • Quasar payload

  • Blocklisted process makes network request

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Drops startup file

  • Adds Run key to start application

    persistence

  • Legitimate hosting services abused for malware hosting/C2

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2