Extracted

• • Target

    990e4a37aa2c639c582f884fd3430063.exe

  • Size

    1.4MB

  • MD5

    990e4a37aa2c639c582f884fd3430063

  • SHA1

    7b272d8dbead6130f66d6c66b3c9d80d24a4486e

  • SHA256

    e5aa35d2480e58e2b63e14ef64374728d931423cd3f530cb43a107ca4c2a93aa

  • SHA512

    5c1a590cdc3e7beecc0d48f74f417ab4c40afdbab90e02240979a0ffcb86e0f284784857c286d291a2334071d58e1c20a19d7c5bf15bdc59e398e26d3c290748

  • SSDEEP

    24576:U2G/nvxW3Ww0tRp8GiXTBhq7yRDvHcUcjUvy0lr3Tl6icOB/UWoT:UbA30H4zF0UMSAicOB/UWk

  Score

  10^/10

  quasar-evasionspywaretrojanupx

  • Quasar RAT

    Quasar is an open source Remote Access Tool.

    trojanspywarequasar

  • Quasar payload

  • Modifies Windows Firewall

    evasion

  • ACProtect 1.3x - 1.4x DLL software

    Detects file using ACProtect software.

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx

  • Unexpected DNS network traffic destination

    Network traffic to other servers than the configured DNS servers was detected on the DNS port.

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  behavioral1behavioral2