Extracted

• • Target

    2815d5043a92a90186c60390aae45ae8_JaffaCakes118

  • Size

    549KB

  • MD5

    2815d5043a92a90186c60390aae45ae8

  • SHA1

    bd7f9872333566ae83e136c09ed3f485854d178b

  • SHA256

    7558de63436a74c9098a73d93359b9ba95500ad1e1d6fc334e9903a20c8c11a3

  • SHA512

    5e47f07f9a89758275fce74117b5d902d036163e9971caa74f5c6f5d7aaaad0c4c6522b0a9b0a6a1aac1e28d6675ee669da0c6a8a013bc952f1a476edc3dfcad

  • SSDEEP

    12288:GodYzXBmawhPE64UIgElzwyYo+C+k2296qmzGP26QVmGZiNR:lWDBgoUIgEulrk2LHyQVmv

  Score

  10^/10

  quasarrat2020spywaretrojan

  • Quasar RAT

    Quasar is an open source Remote Access Tool.

    trojanspywarequasar

  • Quasar payload

  • Executes dropped EXE

  • Loads dropped DLL

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Drops file in System32 directory

  behavioral1behavioral2