Extracted

• • Target

    Exarospooferv2.5.exe

  • Size

    3.6MB

  • MD5

    e428fb66a0ed55ce99a71fc025bce570

  • SHA1

    82ac2b7ce8ab2134e253c616f3d9f97dd29595de

  • SHA256

    e7cd1d4631752f342bde407a1acfc3e5aabf0da7de711a46987e86d5c6653089

  • SHA512

    8f98abf20884bd25a2f6bb36e890e2b7bd6455edf0495818ebd2197284090ec653480657a3aad71b05e629b9d6e4848dbbca1fa4b8cc1d472988f86aefc88e64

  • SSDEEP

    98304:2SjkfMzf08tygdi18L1aOOwO5SseUFDUv0c/PBAPNkkS1FKPtyTX:2Sjtc8Mgdi1M1LOPSsNF00c/PB6NkKPw

  Score

  10^/10

  quasarexaro spooferdiscoveryspywaretrojan

  • Quasar RAT

    Quasar is an open source Remote Access Tool.

    trojanspywarequasar

  • Quasar family

    quasar

  • Quasar payload

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Drops file in System32 directory

  behavioral1behavioral2