Extracted

• • Target

    863853779cb75e604f7f561e9d6aaeb2b6dab6209b1b45a4224baf6487a19d5e

  • Size

    1.4MB

  • MD5

    0dad74135677936499c2ff723c0a9712

  • SHA1

    37897e154481cd6634527afd05731f6eccc9dd64

  • SHA256

    863853779cb75e604f7f561e9d6aaeb2b6dab6209b1b45a4224baf6487a19d5e

  • SHA512

    3a01cf85838f62ce1a73642079f747be292507d395cbf786e912da47986024a447479c2ebc9dc5d05884741f159b0582bf79d1e2eb16a6e9e51d54590b6b7c07

  • SSDEEP

    24576:U2G/nvxW3Ww0tRp8GiXTBhq7yRDvHcUcjUvy0lr3Tl6icOB/UWoT:UbA30H4zF0UMSAicOB/UWk

  Score

  10^/10

  quasar-evasionspywaretrojanupx

  • Quasar RAT

    Quasar is an open source Remote Access Tool.

    trojanspywarequasar

  • Quasar payload

  • Modifies Windows Firewall

    evasion

  • ACProtect 1.3x - 1.4x DLL software

    Detects file using ACProtect software.

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx

  • Unexpected DNS network traffic destination

    Network traffic to other servers than the configured DNS servers was detected on the DNS port.

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  behavioral1behavioral2