Extracted

• • Target

    Timsistem_Product_Specifications - 2020.07.16.exe

  • Size

    740KB

  • MD5

    bf7fe4334d0b4363d70bd997460588a3

  • SHA1

    dcba20338c5dbde13a8189f0d154e3d650cca99c

  • SHA256

    bbf62b7d87429bb832abb5c8f37635c05be6724eaab9afd13a7780595919f3a2

  • SHA512

    be3739a91180dfc1c391045fe2f9a27be3303f6a8c042cee8af7c0bca73483768c33dd806a464a7fdee1b4203135b1fde132a3edc86bd3122ba83f4b993ac4fa

  • SSDEEP

    12288:E1bl3SKiQ9X5M1EL6GgmV5hT82Hnb6tY1CoO4SOSWGbz3hLkbLvhu:OVoQ9EWe23Q0b6tYbO4e3t

  Score

  10^/10

  quasaralexia-stationspywaretrojanupx

  • Quasar RAT

    Quasar is an open source Remote Access Tool.

    trojanspywarequasar

  • Quasar payload

  • Drops startup file

  • Executes dropped EXE

  • Loads dropped DLL

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Drops file in System32 directory

  • Suspicious use of SetThreadContext

  behavioral1behavioral2