Extracted

• • Target

    SynapseX Revamped V1.5/SynapseXBootstrapper.exe

  • Size

    3.1MB

  • MD5

    9434a1822088cedbce057d280c235864

  • SHA1

    c09173a18e5ae2d9d38bd4d3d196adf1423f924e

  • SHA256

    de29011246319ec8b60774d8c4cad4e8299e27eba6dc7699cd257fbdda338336

  • SHA512

    7461b706ef796abc96d7f2549091061910fdf81a77ae0f8d0c20c5de870164410f5dd3b68e3e33a5bb9b77c3ccf59fd787164530b6d2d03688d4dceccb4fb632

  • SSDEEP

    49152:PvnI22SsaNYfdPBldt698dBcjHHeJ/uBx3ioGdyTHHB72eh2NT:PvI22SsaNYfdPBldt6+dBcjH4/X

  Score

  10^/10

  quasarwindows updatespywaretrojan

  • Quasar RAT

    Quasar is an open source Remote Access Tool.

    trojanspywarequasar

  • Quasar payload

  • Executes dropped EXE

  behavioral1behavioral2

• • Target

    SynapseX Revamped V1.5/bin/SynapseInjector.dll

  • Size

    6.0MB

  • MD5

    9b248dfff1d2b73fd639324741fe2e08

  • SHA1

    e82684cd6858a6712eff69ace1707b3bcd464105

  • SHA256

    39943c30732988289ca346902f007a72124bd98b82e08b0b9739241cdab4018e

  • SHA512

    56784a895f113088e3c92ccd96f354473e5d849fb9d0798868ff5e9477f60854e8bc7c9759c63417c9298f8702abab266722439b445977c6e940da393b8b696c

  • SSDEEP

    98304:whgYUp+QvBY2uccY07B1nG9CHvaxFNErtcKXc17TEBT0VBTFX3NwwJqOft:w2j8YCRGEP0iOvuT0FXKwt

  Score

  9^/10

  evasiontrojan

  • Identifies VirtualBox via ACPI registry values (likely anti-VM)

    evasion

  • Checks BIOS information in registry

    BIOS information is often read in order to detect sandboxing environments.

  • Checks whether UAC is enabled

    evasiontrojan
  behavioral3behavioral4