Extracted

• • Target

    c58cc6410dfc930c70caded805f88e2d.exe

  • Size

    1.4MB

  • MD5

    c58cc6410dfc930c70caded805f88e2d

  • SHA1

    0367375fad04729c9f53b18436e08ff1fe76c153

  • SHA256

    295a185629cf9edf7bcdddd8cf1a68c95bb82f4debfad3f5540075feada42d85

  • SHA512

    8540fd3c97604837b15e0c3d498edc8b0acf3ee93aae95a753ac3fed6416b2e5273938bf0f134ef96bcb9a0cfec16ab7a452865e36abeb0e43d6d096cbbba065

  • SSDEEP

    24576:U2G/nvxW3Ww0tRp8GiXTBhq7yRDvHcUcjUvy0lr3Tl6icOB/UWoT:UbA30H4zF0UMSAicOB/UWk

  Score

  10^/10

  quasar-evasionpersistencespywaretrojanupx

  • Quasar RAT

    Quasar is an open source Remote Access Tool.

    trojanspywarequasar

  • Quasar payload

  • Modifies Windows Firewall

    evasion

  • ACProtect 1.3x - 1.4x DLL software

    Detects file using ACProtect software.

  • Executes dropped EXE

  • Loads dropped DLL

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx

  • Unexpected DNS network traffic destination

    Network traffic to other servers than the configured DNS servers was detected on the DNS port.

  • Adds Run key to start application

    persistence

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  behavioral1behavioral2