Extracted

• • Target

    36dfd5a4664c2d1e078b1258f718f944d7c2f517e274e2a78217387e809b5245

  • Size

    1.3MB

  • MD5

    30d7dcd4a107420445b82d57586d0653

  • SHA1

    4eb0382ba81011804dfdd4d93d1338cfc151d0db

  • SHA256

    36dfd5a4664c2d1e078b1258f718f944d7c2f517e274e2a78217387e809b5245

  • SHA512

    80e2d01dfe55bf94cafaa8ad1cd42f62741e54b08b36e1c95f517c254a08297eb65f0df9ef8bd3c8e516c5324de263662aed168b20517523cdad255d57d6163b

  • SSDEEP

    24576:J9sQDSz3eoh5SpYkryz8u9FYeWPJOFL64zAtb:JSGjnbPJOQ4zmb

  Score

  10^/10

  neshtaquasarrarxdiscoverypersistencespywarestealertrojan

  • Detect Neshta payload

  • Neshta

    Malware from the neshta family is designed to infect itself into other files to spread itself and cause damage.

    persistencespywareneshta

  • Quasar RAT

    Quasar is an open source Remote Access Tool.

    trojanspywarequasar

  • Quasar payload

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Modifies system executable filetype association

    persistence

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2