Extracted

Extracted

• • Target

    AOU2.exe

  • Size

    1.3MB

  • MD5

    6ef27bb17948bf2cd5f17d32506ab25f

  • SHA1

    1cace02f54cb1696be68e2ee291e26c051293a51

  • SHA256

    4a412162a0b00623211b7303bc18b00b76d196ea8343a2c35abc262e9e97c9b2

  • SHA512

    38d33e4f1d445ddbb5a45be34f369e60b22f5c29733e3acec9b156851e8494cd5845d22b2c71794b51c2ae73a890685f35dc1738c0e706f8b93c2272545885de

  • SSDEEP

    24576:0KWHORcD/gtB49yDx553XTWcdjrFY5des+Lpq1qe9UdaRkss0:MHMRBO4TxXTLtLpqjOd+kss

  Score

  10^/10

  quasaroffice04persistencespywarestealertrojan

  • Quasar RAT

    Quasar is an open source Remote Access Tool.

    trojanspywarequasar

  • Quasar payload

  • Drops startup file

  • Executes dropped EXE

  • Loads dropped DLL

  • Reads data files stored by FTP clients

    Tries to access configuration files associated with programs like FileZilla.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Adds Run key to start application

    persistence
  behavioral1behavioral2