Extracted

• • Target

    ad448c26383e2e9a9866ca8799a86188e22c0fc02e81ba33409d9371aa819ac4

  • Size

    1.4MB

  • MD5

    9e5e8e5a2c59c7669dcec8e7827dcb3e

  • SHA1

    0db8d97c0530ebe3bfcefe993e7df3b1ffa21cea

  • SHA256

    ad448c26383e2e9a9866ca8799a86188e22c0fc02e81ba33409d9371aa819ac4

  • SHA512

    93fa5f96860068ffbf66337a58063abeb2f0fe5da748be5bcbc97507450bca32aedb4661befdce1b5c5138d291ed9019cec7a0691816aeea7ba563e850db4325

  • SSDEEP

    24576:U2G/nvxW3Ww0tRp8GiXTBhq7yRDvHcUcjUvy0lr3Tl6icOB/UWoT:UbA30H4zF0UMSAicOB/UWk

  Score

  10^/10

  quasar-evasionspywaretrojanupx

  • Quasar RAT

    Quasar is an open source Remote Access Tool.

    trojanspywarequasar

  • Quasar payload

  • Modifies Windows Firewall

    evasion

  • ACProtect 1.3x - 1.4x DLL software

    Detects file using ACProtect software.

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx

  • Unexpected DNS network traffic destination

    Network traffic to other servers than the configured DNS servers was detected on the DNS port.

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  behavioral1behavioral2