Extracted

• • Target

    Facebook breaker.zip

  • Size

    1.2MB

  • MD5

    60baabf5f07b439be78195450dacff3a

  • SHA1

    4c21ad0c866035b9cd720c904c07d6d5a9f47a8c

  • SHA256

    8f379aea1158c492af7bd6361b1b0c8e5b4d2c73062968eb3231da123c4160df

  • SHA512

    bf4d9b38a0575b7fe0200e3145cabd934abf3abd7192f32080c248b847787de724bae8f02ca6df207f75d4557270f8487e87bcc6100016ac27c5bfa61e498fe1

  • SSDEEP

    24576:sPhAekqOX+cSocIXNgg3DZ0dgBBFegQHfmrcFebKpDH8pZJfXm5gQEd:0h+qOOc+IXPDZnFeQrcUKpDcXm5kd

  Score

  10^/10

  quasarvíctimabankofmontrealcredential_accessdiscoveryphishingspywarestealertrojan

  • Detected bankofmontreal phishing page

    phishingbankofmontreal

  • Quasar RAT

    Quasar is an open source Remote Access Tool.

    trojanspywarequasar

  • Quasar family

    quasar

  • Quasar payload

  • Credentials from Password Stores: Windows Credential Manager

    Suspicious access to Credentials History.

    credential_accessstealer

  • Executes dropped EXE

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  behavioral1