Extracted

• • Target

    87d05f252e2417d280bb8c7110f9913e54e5f89fb209181f47eaaad6553ce549

  • Size

    3.1MB

  • MD5

    4bee5738d5053f4ed951f72ece445d1a

  • SHA1

    ed6ff5aa0d945449d4571c5cab6e5e7c95c32b4b

  • SHA256

    87d05f252e2417d280bb8c7110f9913e54e5f89fb209181f47eaaad6553ce549

  • SHA512

    e55a837099572a9fecf096102bd6a6418c3786065e5b2be756d0f5f1ce817a84269f95a82c82ca2275a30659e13db83cbd62f1e7bb8a5b7f6cc4029153178ef9

  • SSDEEP

    49152:avXI22SsaNYfdPBldt698dBcjHhFKKN3Mf90oGdyTHHB72eh2NT:avY22SsaNYfdPBldt6+dBcjHhQKNr

  Score

  10^/10

  quasardavspywaretrojan

  • Quasar RAT

    Quasar is an open source Remote Access Tool.

    trojanspywarequasar

  • Quasar payload

  • Detects Windows executables referencing non-Windows User-Agents

  • Detects binaries (Windows and macOS) referencing many web browsers. Observed in information stealers.

  • Detects executables containing common artifacts observed in infostealers

  • Executes dropped EXE

  • Drops file in System32 directory

  behavioral1behavioral2