Extracted

• • Target

    RobloxPlayerBeta.exe

  • Size

    67.5MB

  • MD5

    69b21d52c8b81b10eafc8dbb6fe33b55

  • SHA1

    5662285cfe875eb6d009343298818b0cf11a4df2

  • SHA256

    2a6b183aca1fbf8d81610b3a5626b5d0859f66239d249264f72815ddb3cb2d9b

  • SHA512

    ef2df91c0e12823125380b1555a0f2d6079101a5e1b88c475d320876e72ce539f66557195a745aeeb819c815a9869ab6e8c6b5bbfdf1b6e43763cc4fa168f941

  • SSDEEP

    1572864:9wix2iSIjf6L706qvF9sxCuMN/wlr8QUP6+SHT3TVdTO7iGM:+ix/fn6qzECuMNIrrUP6RHThTF

  Score

  10^/10

  executionquasarspywaretrojan

  • Quasar RAT

    Quasar is an open source Remote Access Tool.

    trojanspywarequasar

  • Quasar payload

  • Blocklisted process makes network request

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Legitimate hosting services abused for malware hosting/C2

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  behavioral1behavioral2