Extracted

• • Target

    real.exe

  • Size

    409KB

  • MD5

    16be7896ffd96f3c15ca40ff3243674f

  • SHA1

    321e82e120535d5f48430284804d5aca5f78d8c7

  • SHA256

    e297f022413aee60290878fd253b68ecb9af7e7919ddae6093a977c10b47ca07

  • SHA512

    6dda93f0e4e47caf40bf15372fd8edee36b8a66d4d6ee3a6e1400c9297cbaa32584c6f8c97e2e76c4e3cd8b195d8e9cbb898870559e7a7177db97eb8c0a521ad

  • SSDEEP

    12288:8Bwz9Fx/nIlyLcnRKIZduz8IWQygCLZG9:8+J0sLYpuz8bQygB

  Score

  10^/10

  quasarrslavesspywaretrojan

  • Quasar RAT

    Quasar is an open source Remote Access Tool.

    trojanspywarequasar

  • Quasar payload

  • Suspicious use of NtCreateUserProcessOtherParentProcess

  • Downloads MZ/PE file

  • Executes dropped EXE

  • Legitimate hosting services abused for malware hosting/C2

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Drops file in System32 directory

  • Suspicious use of SetThreadContext

  behavioral1behavioral2behavioral3