Extracted

• • Target

    3c5a4a6e0984220de5f8945f7e7d2fb7_JaffaCakes118

  • Size

    470KB

  • MD5

    3c5a4a6e0984220de5f8945f7e7d2fb7

  • SHA1

    d8cc682345256e7529c06bf6dc61bd262bfb724f

  • SHA256

    8ad13febcc803f9ee8a83e5e5dad20e4ab0083b206d2b2c1e1bd5809125031be

  • SHA512

    22ecf95c7aab5c71beda5cf45f07d10e3d7b174751d46d5f157239272b84ec4001cc1ddcc4cc9d49c6c70dbb64cdda6e3b0111a0cb53266d23ded811f8905aa0

  • SSDEEP

    6144:58E5banFRAD6ByRaFqLjWg5iVkLWHJsFZMrATekM5fLH7kWBxjdpCPyS9TDEx:t6ROuBOjWvVkLWH+TjSllDhBrpCP2

  Score

  10^/10

  quasaroffice04spywaretrojan

  • Quasar RAT

    Quasar is an open source Remote Access Tool.

    trojanspywarequasar

  • Quasar payload

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Drops startup file

  • Executes dropped EXE

  • Loads dropped DLL

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  behavioral1behavioral2