Extracted

• • Target

    faeb068c20cbe9e1778e2d6edebad8d5a97cf081b52f1e625066fdab6eb8c154

  • Size

    1.4MB

  • MD5

    5028526669cbe4d826de03f118a3ac88

  • SHA1

    a7e818e543af24fdbe7c4ce0b864c91e7a456bb1

  • SHA256

    faeb068c20cbe9e1778e2d6edebad8d5a97cf081b52f1e625066fdab6eb8c154

  • SHA512

    c29fd9e374be03aedfdd8c1ebe00748b50d587114e0c14a82fe83e574e640afe3b92d9f13aa9508a33947b59afe3642102aa787a0f8dc6d0272ec5927b360c92

  • SSDEEP

    24576:U2G/nvxW3Ww0tRp8GiXTBhq7yRDvHcUcjUvy0lr3Tl6icOB/UWoT:UbA30H4zF0UMSAicOB/UWk

  Score

  10^/10

  quasar-evasionspywaretrojanupx

  • Quasar RAT

    Quasar is an open source Remote Access Tool.

    trojanspywarequasar

  • Quasar payload

  • Modifies Windows Firewall

    evasion

  • ACProtect 1.3x - 1.4x DLL software

    Detects file using ACProtect software.

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx

  • Unexpected DNS network traffic destination

    Network traffic to other servers than the configured DNS servers was detected on the DNS port.

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  behavioral1behavioral2