Extracted

• • Target

    lchs.txt

  • Size

    3.4MB

  • MD5

    45135fb081a6c819f57b8af5d643fa0a

  • SHA1

    41d53a31c8fd14780eb5ddbed85bc893c537d8b1

  • SHA256

    02c614d149eeba84d88bb0bf9054c63a43edd5ae2993d3cb45b669cd7e590662

  • SHA512

    a013dc1e56ff12ad7a2137de92a2b154bbe1563ef19a7770ad3241d4218946db4811c06b92e06dfee29fd7ff8e7e679474005ccea80abd8dd6ef1476ee39d29c

  • SSDEEP

    98304:/zUa0ps1XffeC+/qLwLi0mRqDZwqRY9GBN/txR:/zBUEmCbLsi0mEDmqR/zR

  Score

  10^/10

  quasar25-09-2024-mscdiscoveryspywaretrojanstealer

  • Quasar RAT

    Quasar is an open source Remote Access Tool.

    trojanspywarequasar

  • Quasar payload

  • Suspicious use of NtCreateUserProcessOtherParentProcess

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Drops startup file

  • Executes dropped EXE

  • Loads dropped DLL

  • Reads WinSCP keys stored on the system

    Tries to access WinSCP stored sessions.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Enumerates processes with tasklist

    discovery
  behavioral1behavioral2