Extracted

• • Target

    srxchost.exe

  • Size

    409KB

  • MD5

    3646d83b4b68c7a7de0c4cb99c6550c9

  • SHA1

    1f84405a3a18a24d58eb62a13dd1cfe5c4b6d3d1

  • SHA256

    12dc2f09f5cb5160771e12b5128de26fde6bab70cee6d063859eea955df1216c

  • SHA512

    707b7b35f9504fa4b18ca1175e010771e67c3096b2d7552dc03c0bfb1bb377bfe360e2b49ce3ebc1408b6fac9838e5b8af26721650e8b5823969a12501fb0107

  • SSDEEP

    12288:9piREGJiVp4B6eODSwejGz1VIudSJRZfwmJweOJsn:TwpJj8Nd+RZImJf

  Score

  10^/10

  quasarseroxen | v3.1.5 |spywaretrojan

  • Quasar RAT

    Quasar is an open source Remote Access Tool.

    trojanspywarequasar

  • Quasar payload

  • Executes dropped EXE

  • Loads dropped DLL

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Drops file in System32 directory

  behavioral1behavioral10behavioral11behavioral12behavioral2behavioral3behavioral4behavioral5behavioral6behavioral7behavioral8behavioral9