Extracted

• • Target

    7a39783b4df44b14c0bc4a9ab62c2870

  • Size

    18.9MB

  • MD5

    7a39783b4df44b14c0bc4a9ab62c2870

  • SHA1

    1278ed63bad5d24546584f274527a7c314df8867

  • SHA256

    850a2cee4c34bee8c6ee76162c2ead42a8f537e59d257e495b3f0d190c8fd606

  • SHA512

    d20beda7af98aea8d27e7423aa1fcb979bd966996848be2cccf9041a6545882be2c241c83d93df318818d7495262020927e0d82abfffe6ef5495415fd9106ca2

  • SSDEEP

    393216:rIJm/0ywuOkd8cKjti/2gRJl9Y06abayqgiJXfd9lYbhsk8:rIJVz483iugR39YMsgqXfzlYbm

  Score

  10^/10

  discoveryquasarbrave21spywaretrojan

  • Quasar RAT

    Quasar is an open source Remote Access Tool.

    trojanspywarequasar

  • Quasar payload

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Drops startup file

  • Executes dropped EXE

  • Loads dropped DLL

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2