Extracted

• • Target

    97ea1071bd6cee9cfeae027600f958429b1564dcd16584482bf66a8f21454ecd

  • Size

    1.4MB

  • MD5

    b841fb34d646b046ecf80b647efded35

  • SHA1

    f932c320eb44d95d5e6193c85c5dab62d21868fb

  • SHA256

    97ea1071bd6cee9cfeae027600f958429b1564dcd16584482bf66a8f21454ecd

  • SHA512

    b406b513a98ac83a78bdda6772db79e2d6aad57247a5bd74dc9a4691b0a460c7a7058276c8241a433e9f74d561d5ddc1b64191cc2fc61bef0df1ee55f2488f4d

  • SSDEEP

    24576:U2G/nvxW3Ww0tRp8GiXTBhq7yRDvHcUcjUvy0lr3Tl6icOB/UWoT:UbA30H4zF0UMSAicOB/UWk

  Score

  10^/10

  quasar-evasionspywaretrojanupx

  • Quasar RAT

    Quasar is an open source Remote Access Tool.

    trojanspywarequasar

  • Quasar payload

  • Modifies Windows Firewall

    evasion

  • ACProtect 1.3x - 1.4x DLL software

    Detects file using ACProtect software.

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx

  • Unexpected DNS network traffic destination

    Network traffic to other servers than the configured DNS servers was detected on the DNS port.

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  behavioral1behavioral2