Extracted

• • Target

    ba1a3eca6478d3dd2a29595b6d5463801c2211dad885f2445fee19cb9ae1cbb1

  • Size

    1.4MB

  • MD5

    ad30a8a281efd3376af8075187c7cb2e

  • SHA1

    b26136fbbc8070fc8574d3bef2bf162086e0c3b5

  • SHA256

    ba1a3eca6478d3dd2a29595b6d5463801c2211dad885f2445fee19cb9ae1cbb1

  • SHA512

    72d74edec60b66d19eb4cb56003193f0ddf89e7cd198e5595d851186e8dcdc0ccdf45f8f9648e5ad1b8b0c8ea820a631a86c799536068dae26f7e6f5beeef7e7

  • SSDEEP

    24576:U2G/nvxW3Ww0tRp8GiXTBhq7yRDvHcUcjUvy0lr3Tl6icOB/UWoT:UbA30H4zF0UMSAicOB/UWk

  Score

  10^/10

  quasar-evasionpersistencespywaretrojanupx

  • Quasar RAT

    Quasar is an open source Remote Access Tool.

    trojanspywarequasar

  • Quasar payload

  • Modifies Windows Firewall

    evasion

  • ACProtect 1.3x - 1.4x DLL software

    Detects file using ACProtect software.

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx

  • Unexpected DNS network traffic destination

    Network traffic to other servers than the configured DNS servers was detected on the DNS port.

  • Adds Run key to start application

    persistence

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  behavioral1behavioral2