Extracted

• • Target

    9ded64087b76f48dfa80c95ceffbf11ec7e442bdaed4cebdef40a3ed2593f86b

  • Size

    1.4MB

  • MD5

    3f67be83722c1b395fc4bcec2dd81866

  • SHA1

    d67e4a209f94b6a051d96a12d609f32e453416c4

  • SHA256

    9ded64087b76f48dfa80c95ceffbf11ec7e442bdaed4cebdef40a3ed2593f86b

  • SHA512

    7517fe15e10e67a21b59869443b2154c39d334c63f3750ca20daa05d815d31c231143a16caf30923a205e858ffde195bea44164e4feb8aa01c5e837d8a8621a8

  • SSDEEP

    24576:U2G/nvxW3Ww0tRp8GiXTBhq7yRDvHcUcjUvy0lr3Tl6icOB/UWoT:UbA30H4zF0UMSAicOB/UWk

  Score

  10^/10

  quasar-evasionpersistencespywaretrojanupx

  • Quasar RAT

    Quasar is an open source Remote Access Tool.

    trojanspywarequasar

  • Quasar payload

  • Modifies Windows Firewall

    evasion

  • ACProtect 1.3x - 1.4x DLL software

    Detects file using ACProtect software.

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx

  • Unexpected DNS network traffic destination

    Network traffic to other servers than the configured DNS servers was detected on the DNS port.

  • Adds Run key to start application

    persistence
  behavioral1behavioral2