Extracted

• • Target

    ctt.exe

  • Size

    1018KB

  • MD5

    a9f320e3029b0c53c416b96db522707a

  • SHA1

    90bc4db1db8aac97be94ab8c35ba6c72ddbfae2d

  • SHA256

    8babb109a6f8beacac92c1a6d44fab8f7e75004356202b017166caef6ae93664

  • SHA512

    72a1be6ab09f7a9c5b032e2b042144432981feee2c67a36989b0bda15a446b6b9d078e56c0b368ce99ea0246ae56ab710268d4ac4d5f69ab34de5533f71e7906

  • SSDEEP

    24576:kbi/QhDC8mY93kyw8hC2A5CxLbRpWrzzZyP4UMdZn6x3AUn://QMnl5YL7WzZyQRdKf

  Score

  10^/10

  quasaroffice04discoveryevasionspywaretrojan

  • Quasar RAT

    Quasar is an open source Remote Access Tool.

    trojanspywarequasar

  • Quasar family

    quasar

  • Quasar payload

  • Identifies VirtualBox via ACPI registry values (likely anti-VM)

    evasion

  • Downloads MZ/PE file

  • Executes dropped EXE

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Legitimate hosting services abused for malware hosting/C2

  behavioral1