Extracted

• • Target

    389c77b4d588a7264038f89766fff7cb90e204b1168a05350a61c86c6e70e87aN

  • Size

    816KB

  • MD5

    11ec645f6c65c2a60ac9c8076511e460

  • SHA1

    6095caa8b0790e6acf1354f03d7b9f96068c3c77

  • SHA256

    389c77b4d588a7264038f89766fff7cb90e204b1168a05350a61c86c6e70e87a

  • SHA512

    0e8be6b5cdd90b78046e015ee899dc43d88358d4c840477a1cbc10cd40144e67c23326861639fd96c5d93571b479d1494b61313e34a3fb3bff0f10207cbdf2a4

  • SSDEEP

    24576:mElnsFEcdvyHasjGX+oDeYVfh+vnkm51sdyU:HlnszqCXPeYckW1sdyU

  Score

  10^/10

  quasaroffice04discoveryexecutionspywaretrojan

  • Quasar RAT

    Quasar is an open source Remote Access Tool.

    trojanspywarequasar

  • Quasar family

    quasar

  • Quasar payload

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2