Extracted

• • Target

    https://drive.google.com/file/d/19dtPJV6XBEH8ZjCCr3OlGMEzgJOkNogL/view?pli=1

  Score

  10^/10

  quasarzgrateaseustodo discoverypersistenceratspywaretrojan

  • Detect ZGRat V2

  • Modifies WinLogon for persistence

    persistence

  • Quasar RAT

    Quasar is an open source Remote Access Tool.

    trojanspywarequasar

  • Quasar payload

  • ZGRat

    ZGRat is remote access trojan written in C#.

    ratzgrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Legitimate hosting services abused for malware hosting/C2

  • Network Share Discovery

    Attempt to gather information on host network.

    discovery

  • Suspicious use of SetThreadContext

  behavioral1