Extracted

• • Target

    RobloxPlayerInstaller (13).zip

  • Size

    1.2MB

  • MD5

    840ef91421c4400dc0a3e1e1f3ef1b92

  • SHA1

    07968814c9bf4a79095521a3d061479fb448b4f2

  • SHA256

    c37d667cca66b515320fa07eaae06bf71500e37710313768ee8c7aafdff1efc0

  • SHA512

    ab9d4e71ab658b234491cb26fce13f9cb26afc02507e7db9c0f394b3aac309e891beaa6e0924e643fc45cad5ab2b6cc486531f9f26df1682cb78ffd108d4838f

  • SSDEEP

    24576:xnyrKuNpHU/A6ujK2zC4MwKi4bKeInEAjlQm5JmDwwyV6CftEecaR3iU:xsBpHeVu2g/hqInPa9e6YEMRyU

  Score

  10^/10

  quasaroffice04discoveryspywarestealertrojan

  • Quasar RAT

    Quasar is an open source Remote Access Tool.

    trojanspywarequasar

  • Quasar family

    quasar

  • Quasar payload

  • Executes dropped EXE

  • Reads WinSCP keys stored on the system

    Tries to access WinSCP stored sessions.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Drops file in System32 directory

  behavioral1