Extracted

• • Target

    43738a30c4074ca0bef77f528fb75fb1_JaffaCakes118

  • Size

    349KB

  • MD5

    43738a30c4074ca0bef77f528fb75fb1

  • SHA1

    4197ff900d723691b0b33a924b6b34ad4dc15f33

  • SHA256

    212755a6fea93a698fcc12d08bdb6531c113377e8ddeef0c3185e54f3d2576ac

  • SHA512

    86d38ae3a245c155dfaef3a0928923bbccb338daae365b896c672aa98634376bfb113bb45c1bca68f361fc9cce964e1c12ab9971319779ba6f88c84370c2b259

  • SSDEEP

    6144:9K2J10qdSlEc39HG0qwmaS23MF+zK5rqt5YOqhLbyfdAVo2Vdd0d:9KFjq7c3FzK5rqcOYyKVoWdd0d

  Score

  10^/10

  quasaroffice04spywaretrojan

  • Quasar RAT

    Quasar is an open source Remote Access Tool.

    trojanspywarequasar

  • Quasar payload

  • Executes dropped EXE

  • Loads dropped DLL

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  behavioral1behavioral2