Extracted

• • Target

    SolaraBootstrapper.exe

  • Size

    4.7MB

  • MD5

    8e188560eca9ec36adb33425dd5ded3a

  • SHA1

    8ff3c27b9d50e0eda7a7df3a94ecd701f4632c4d

  • SHA256

    f7f233269f149d89c2178a456e9d858c366d41b525a7655a5c6633bc27914e1f

  • SHA512

    da2d41f5a960b82dd5281932eedbd2df941df1a5a7a5dbbb7a0621bb483a3366932b5b9d4b7d64ce21eb8e8a492338a48ca9ee57781d38c3427e5a31f5a68ee2

  • SSDEEP

    49152:fdKiv3rs1xLqz9kD7XH3iXQ7JY89kWfKn1KO+zW5GbClxAT8b7ZwQI7y:fUfx+zCniXQ71kWfKn1RBNfg7y

  Score

  10^/10

  quasaroffice04spywarestealertrojan

  • Quasar RAT

    Quasar is an open source Remote Access Tool.

    trojanspywarequasar

  • Quasar payload

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Reads WinSCP keys stored on the system

    Tries to access WinSCP stored sessions.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  behavioral1