Extracted

• • Target

    Uni.exe

  • Size

    409KB

  • MD5

    16e4226eddebe2148b46353c351ec570

  • SHA1

    5879aab64c4d4c086f24807f85c3f1bec657db9c

  • SHA256

    04f86ef6a2870bcaff958187d1bbf7281e6c8c1c1f2fbefddc11e3a379e4f9b9

  • SHA512

    7fa89b0aee061fca53534c7e38dfa873235095e32f64e87d7a8457e765f804d8f2408e90b90a484ea3e9c18d1110a5667de9aab14d9d9e22911433e9da4cfd38

  • SSDEEP

    6144:cMfPp5S6M1Xy0vjzilQA9QU9sX0bx4UmWOQ6rhxODbfFOqb:Rpg6M1i+jzilQoAVUmjJtx2fF5b

  Score

  10^/10

  quasarseroxenspywaretrojan

  • Quasar RAT

    Quasar is an open source Remote Access Tool.

    trojanspywarequasar

  • Quasar payload

  • Suspicious use of NtCreateUserProcessOtherParentProcess

  • Checks BIOS information in registry

    BIOS information is often read in order to detect sandboxing environments.

  • Executes dropped EXE

  • Legitimate hosting services abused for malware hosting/C2

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Drops file in System32 directory

  • Suspicious use of SetThreadContext

  behavioral1