Extracted

Extracted

• • Target

    vcac.exe

  • Size

    24.2MB

  • MD5

    bd60bf2d7f1f2f813f22005f645b54a6

  • SHA1

    f26fd66a37d21522bcc3bb95dd1a0af12d3978cc

  • SHA256

    b416ba3614cf4d62af4a1a558d2ca647ecf8196b251217e6d5809f5044bb4d9b

  • SHA512

    1522830159961b626f0b16bdc5daa1923f7a911b7a80718143fe8cf6737bd86f25425d23badb7137319ed80afedf0a70914dfd40a071bde1507ab4d9bb999cc9

  • SSDEEP

    98304:qKBbBWIgWljGxRB/LLqvc22SsaNYfdPBldt6+dBcjHVCU688cIyGOk3ta:P4xRBj4B7j4U6gl

  Score

  10^/10

  quasaruserbootkitcollectiondiscoveryevasionexploitpersistencepyinstallerransomwarespywarestealertrojan

  • Quasar RAT

    Quasar is an open source Remote Access Tool.

    trojanspywarequasar

  • Quasar payload

  • Deletes shadow copies

    Ransomware often targets backup files to inhibit system recovery.

    ransomware

  • Disables Task Manager via registry modification

    evasion

  • Drops file in Drivers directory

  • Modifies Windows Firewall

    evasion

  • Possible privilege escalation attempt

    exploit

  • Drops startup file

  • Executes dropped EXE

  • Loads dropped DLL

  • Modifies file permissions

    discovery

  • Reads data files stored by FTP clients

    Tries to access configuration files associated with programs like FileZilla.

    spywarestealer

  • Reads local data of messenger clients

    Infostealers often target stored data of messaging applications, which can include saved credentials and account information.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Adds Run key to start application

    persistence

  • Drops desktop.ini file(s)

  • Legitimate hosting services abused for malware hosting/C2

  • Writes to the Master Boot Record (MBR)

    Bootkits write to the MBR to gain persistence at a level below the operating system.

    bootkitpersistence

  • Drops file in System32 directory

  • Sets desktop wallpaper using registry

    ransomware
  behavioral1