Extracted

• • Target

    CzSOSINT.exe

  • Size

    297KB

  • MD5

    311c6835775d900f12ece1d138aee2a6

  • SHA1

    95ea06961562ddfa77f645be03f95d08d1cdb2e0

  • SHA256

    31f0e68a0fb8a6e1714ade7379d486d56aa1421d2f22ff3d632c1fe24f59457a

  • SHA512

    19cc40219e209fc878ea2beb5cb81917cd3bf43684d9c1d42643581c38b5db393ae8c2362d167521002e466a80fe24b08163aefda5aa7d266b4731f5c985d500

  • SSDEEP

    6144:9eQCIpHePBK7UOYz1mhJCtWY9XcNfPHDpu74NpgtcZRg/+wPO:0ae5mYzcLC0YuF8kHX/g/

  Score

  10^/10

  quasarrslavereelspywaretrojan

  • Quasar RAT

    Quasar is an open source Remote Access Tool.

    trojanspywarequasar

  • Quasar payload

  • Suspicious use of NtCreateUserProcessOtherParentProcess

  • Downloads MZ/PE file

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Legitimate hosting services abused for malware hosting/C2

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Drops file in System32 directory

  • Suspicious use of SetThreadContext

  behavioral1behavioral2