Extracted

• • Target

    ed098d7dc50ce75bc364fe18d99df66e3761a74f234f4bcf96f2895dd0c1fbc4N

  • Size

    3.6MB

  • MD5

    eaab27b2ddf8f180a9a39cf41cc315b0

  • SHA1

    3911cd0517ffc749813b0d37a24748e1b7f87840

  • SHA256

    ed098d7dc50ce75bc364fe18d99df66e3761a74f234f4bcf96f2895dd0c1fbc4

  • SHA512

    2aa9745e51b51e613b1e64e21d29beb2a324b53dfff8a3c02952b4c679e392acf43e1b8fa71d427b1105fdd7f6b9067e1c69b477507971d8e89d00b35a32d405

  • SSDEEP

    98304:WePiQC7Nny+mfIydB6Yd0dfs+bkhDKN4MyiGny:3PiQkty/ZdB5aJkTny

  Score

  10^/10

  discoveryexecutionpersistencequasaroffice04spywaretrojan

  • Quasar RAT

    Quasar is an open source Remote Access Tool.

    trojanspywarequasar

  • Quasar payload

  • Adds Run key to start application

    persistence

  • Command and Scripting Interpreter: PowerShell

    Using powershell.exe command.

    execution

  • Suspicious use of SetThreadContext

  behavioral1behavioral2