Extracted

• • Target

    Update.exe

  • Size

    413KB

  • MD5

    1646711c224bff90075c63e282c7a509

  • SHA1

    dcb31c89ea750a0c7f201f0b35ec886d7f56b485

  • SHA256

    b11faba7760b0fdb433ab416944a6c420db27216981aee61749f44bb51e61cb8

  • SHA512

    826a1cf500ae1802bf55e5e73525e6a7c14a9e788c8e779291675b47e0a18424e49e369e39d3861b0e8491d230b5019c8db38632ee16f78a27fa8929c9d007df

  • SSDEEP

    6144:aNmEjkzQT1TVNVSSL+4LuTWhDW3+y4WbjHSKr1MkP+7ZKvxueoLqGGe:i1TVV7ScaYS3vrHSKr1M85vxueoLlGe

  Score

  10^/10

  quasaroffice04discoveryexecutionspywaretrojan

  • Quasar RAT

    Quasar is an open source Remote Access Tool.

    trojanspywarequasar

  • Quasar payload

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Command and Scripting Interpreter: PowerShell

    Run Powershell and hide display window.

    execution

  • Drops file in Drivers directory

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  behavioral1behavioral2