Extracted

• • Target
    krummy-lavacrypt-gfhd.exe
  • Size 3.5MB
  • SHA256 28b7e5568fcbab776e1bbb1be485a4299a760240fe4b1c60cb3ce68a0e0c4ba6
  • MD5 af1082c667a09a0f1f6adb041ca37d34
  • SHA1 ccb770b00596a1d2fa0d9d7d3dbe9451734a30f9
  • SHA512 4d1c50b42077ec0a8f0060410e75201e920b951f299e8d9a247fb4ba3c920ef5d16f7b30e2decef5323d88e28e3daeee60ae3fcd1e00de36e0185336b1582404
  • SSDEEP 98304:p99xyD6/xKyfNf6wZsi/0+zqEsf+JQgWq:rXIc7fNf6Y4EsWxR
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  quasarslaveevasionpersistencespywaretrojan

  • Quasar RAT

    Quasar is an open source Remote Access Tool.

    trojanspywarequasar

  • Quasar payload

  • UAC bypass

    evasiontrojan

  • Windows security bypass

    evasiontrojan

  • Looks for VirtualBox Guest Additions in registry

    evasion

  • Looks for VMWare Tools registry key

    evasion

  • Checks BIOS information in registry

    BIOS information is often read in order to detect sandboxing environments.

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Windows security modification

    evasiontrojan

  • Adds Run key to start application

    persistence

  • Checks whether UAC is enabled

    evasiontrojan

  • Maps connected drives based on registry

    Disk information is often read in order to detect sandboxing environments.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2