Extracted

• • Target

    Bitcoin+Fake+Transac...rar

  • Size

    304.8MB

  • MD5

    276e47ce2deff90b6e7c0ea9496b91bf

  • SHA1

    a139f00c2224303a5966a4e640ba62e0b5093bba

  • SHA256

    e3f036ecd6f6b22ed68fdfa2c6e211a3ad0b2efd4b202c51e1a94dcc343e6bab

  • SHA512

    90af10dd5d1f1916492518cbacd162bfabceae26d6f8681e5dde517c3e24cb8d04280bae41dd947e5462ab00d22ec9113f19bc323c15ce40bfdaa3861e3d3e9f

  • SSDEEP

    6291456:2PE5JH1U8fbAZiTS7a5Wq0haXAeldkl9uivCVaVfR/JSiYI8z8MZhekn+mq/HWlg:qUpLS3LoXAEdCjVfR/JWI8z8MZheU+mO

  Score

  10^/10

  quasarbtc viruspersistencespywaretrojan

  • Quasar RAT

    Quasar is an open source Remote Access Tool.

    trojanspywarequasar

  • Quasar payload

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • Drops file in System32 directory

  behavioral1behavioral2behavioral3behavioral4