Extracted

Extracted

• • Target

    268934cf9ac4371ad4e8afdc7e354cce287e9f2ce019df0797cc354b3a2efca0.exe

  • Size

    11.4MB

  • MD5

    2f3b5b60129dc43350bc54e67d59a4ac

  • SHA1

    08cdc5d4d0628c619897bf465f279f7d30d42b9f

  • SHA256

    268934cf9ac4371ad4e8afdc7e354cce287e9f2ce019df0797cc354b3a2efca0

  • SHA512

    725593bf2587bd1c2a8c5be02c168ad739010118f68606df1234a0aa1c31f582556a0139539f3068e7f174cd516956be608d05c6a597720138556a8a606fb749

  • SSDEEP

    196608:+XeSEzpCQdLjv+bhqNVoB8Ck5c7GpNlpq41J2mrl0bk9qtlDfJpNZYXz:q4PL+9qz88Ck+7q3p91JNRqfg

  Score

  10^/10

  discordratquasarr3persistenceratrootkitspywarestealertrojanupxexecution

  • Discord RAT

    A RAT written in C# using Discord as a C2.

    stealerrootkitratpersistencediscordrat

  • Quasar RAT

    Quasar is an open source Remote Access Tool.

    trojanspywarequasar

  • Quasar payload

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Drops file in System32 directory

  behavioral1behavioral2