Extracted

Extracted

• • Target

    184d7427be227ca0505c4baf5a9d3756534f399b052309e19ba819d06d03a543.lnk

  • Size

    2KB

  • MD5

    4a98c5bbf1a94992ec72858d3327a28e

  • SHA1

    0fa914c44bdcb63d3631d5ec30cebb5047d12c7a

  • SHA256

    184d7427be227ca0505c4baf5a9d3756534f399b052309e19ba819d06d03a543

  • SHA512

    e60fb58d1f141d3c2ea99bf39d3b0dd872bebc05efa0cfa630e783f4d90b624084988c66621adc4d7dc6434b1c707d1d6c7c1f36ee2fa2e36fefc47b9a7d6ba7

  Score

  10^/10

  quasarvtroydiscoveryexecutionspywaretrojan

  • Quasar RAT

    Quasar is an open source Remote Access Tool.

    trojanspywarequasar

  • Quasar family

    quasar

  • Quasar payload

  • Blocklisted process makes network request

  • Command and Scripting Interpreter: PowerShell

    Run Powershell and hide display window.

    execution

  • Downloads MZ/PE file

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2