Extracted

• • Target

    msjO.hta

  • Size

    62KB

  • MD5

    da5de2b74995076618fe814857073997

  • SHA1

    2891a832f6f327a77b5bf8280c13fce76e35b7fe

  • SHA256

    ae8c4f72c13b4103e0e977bbf2939a4b97860d1c279994d1b0bd27e00cbf8c2f

  • SHA512

    74e31514a029f9577cf084a0a040f7bc56706f90afd0a079f8e5f56e024b2c2f7f8a6cc8f8a4d9ac70dd07eb4d8b48987a8ad4a784f3d883e484015c63bd595d

  • SSDEEP

    768:8lxvAqQiY1Qgph+3/ziRGrirzlQj3KIbd7RJSAIjK+4mmLFpLgZakmM:8xvAqQiSphvrCj3KIbd7RFxdBpMdmM

  Score

  10^/10

  persistencequasarcashingspywarestealertrojan

  • Quasar RAT

    Quasar is an open source Remote Access Tool.

    trojanspywarequasar

  • Quasar payload

  • Blocklisted process makes network request

  • Downloads MZ/PE file

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Reads data files stored by FTP clients

    Tries to access configuration files associated with programs like FileZilla.

    spywarestealer

  • Reads user/profile data of local email clients

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Adds Run key to start application

    persistence
  behavioral1behavioral2