Extracted

• • Target

    8168236516ecd464c7c004c1d824ace70932b9dd61c9e238256965c33f059583

  • Size

    3.1MB

  • MD5

    c52e8cb313bd0e446cb9607636bbc6ec

  • SHA1

    77d3ca1584e486528e39802449027cd9e8b08b83

  • SHA256

    8168236516ecd464c7c004c1d824ace70932b9dd61c9e238256965c33f059583

  • SHA512

    d8bdbad8a179c74f2479da58af5530782a1683e07ad656b91ee05b0b00daa8008d1e7143b34eae16ef6ef612e1f742832ae9b9167ac2286799075886d1a66a45

  • SSDEEP

    49152:KvWI22SsaNYfdPBldt698dBcjHS5RJ6PbR3LoGdBTHHB72eh2NT:Kv722SsaNYfdPBldt6+dBcjHS5RJ6h

  Score

  10^/10

  quasarvictimspywaretrojan

  • Quasar RAT

    Quasar is an open source Remote Access Tool.

    trojanspywarequasar

  • Quasar payload

  • Detects Windows executables referencing non-Windows User-Agents

  • Detects binaries (Windows and macOS) referencing many web browsers. Observed in information stealers.

  • Detects executables containing common artifacts observed in infostealers

  • Executes dropped EXE

  • Drops file in System32 directory

  behavioral1behavioral2