Extracted

• • Target

    9740b8125ee7514574c5abf44f81b0093fb835c96be4ee008664ffda7ac4c0d2

  • Size

    1.4MB

  • MD5

    2ca1d8c2ed7a7a6f8580a6f9797c473e

  • SHA1

    02d8f11b4b3076ce6fff19a75a9f6e565135b490

  • SHA256

    9740b8125ee7514574c5abf44f81b0093fb835c96be4ee008664ffda7ac4c0d2

  • SHA512

    d43df5e64108c77f947884615d5fefedf9b6a4a8cd66acc0449a1f24d7e3eefe3c67afcbc1e25969e5e37ff079d9b8272bfc3bddc2a9b3ca3ae64055991c3f99

  • SSDEEP

    24576:U2G/nvxW3Ww0tRp8GiXTBhq7yRDvHcUcjUvy0lr3Tl6icOB/UWoT:UbA30H4zF0UMSAicOB/UWk

  Score

  10^/10

  quasar-evasionspywaretrojanupx

  • Quasar RAT

    Quasar is an open source Remote Access Tool.

    trojanspywarequasar

  • Quasar payload

  • Modifies Windows Firewall

    evasion

  • ACProtect 1.3x - 1.4x DLL software

    Detects file using ACProtect software.

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx

  • Unexpected DNS network traffic destination

    Network traffic to other servers than the configured DNS servers was detected on the DNS port.

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  behavioral1behavioral2