Extracted

• • Target

    Client-built.exe

  • Size

    3.1MB

  • MD5

    97cd39b10b06129cb419a72e1a1827b0

  • SHA1

    d05b2d7cfdf8b12746ffc7a59be36634852390bd

  • SHA256

    6bc108ddb31a255fdd5d1e1047dcd81bc7d7e78c96f7afa9362cecbb0a5b3dbc

  • SHA512

    266d5c0eb0264b82d703d7b5dc22c9e040da239aaca1691f7e193f5391d7bafc441aff3529e42e84421cf80a8d5fca92c2b63019c3a475080744c7f100ea0233

  • SSDEEP

    49152:Kv7I22SsaNYfdPBldt698dBcjH2CRJ6nbR3LoGdDyaTHHB72eh2NT:KvE22SsaNYfdPBldt6+dBcjH2CRJ65T

  Score

  10^/10

  quasarromkabootkitpersistencespywarestealertrojan

  • Quasar RAT

    Quasar is an open source Remote Access Tool.

    trojanspywarequasar

  • Quasar payload

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Reads WinSCP keys stored on the system

    Tries to access WinSCP stored sessions.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Writes to the Master Boot Record (MBR)

    Bootkits write to the MBR to gain persistence at a level below the operating system.

    bootkitpersistence
  behavioral1behavioral2