Extracted

• • Target

    4c5517f7d4f0e77f98f8c3f033ac0269_JaffaCakes118

  • Size

    255KB

  • MD5

    4c5517f7d4f0e77f98f8c3f033ac0269

  • SHA1

    fc4c6890bb5cb90d4492995b0f18d9cea022a9a2

  • SHA256

    98428fa8e72274d66f364f230fd1800f6c79f9a82b302e796234cf93e889eb87

  • SHA512

    aea401db7f8f533f079702aaa5c2013ba94d18cd839267ebf00c079d36689711a6f10ada957d6d876b8906c778811f41b71ca8ce52f06a156ba0f2ad966b5403

  • SSDEEP

    6144:GunF3/mw+NhZ7cJfqG0K+UvhvEnbEsxM0i:GEJiG0KXsxM0i

  Score

  10^/10

  quasarinfectspywaretrojan

  • Quasar RAT

    Quasar is an open source Remote Access Tool.

    trojanspywarequasar

  • Quasar payload

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  behavioral1behavioral2