Extracted

• • Target

    425e3e4f280f19e1de7ced375ab0b31dbd2ffe49ed2684ecb140918d662d58ff.exe

  • Size

    3.2MB

  • MD5

    58abd80cc431895f2c2126f714ca3c8c

  • SHA1

    9338c3bbe9e6dd3658848c03a5d3bcf02dfbe965

  • SHA256

    425e3e4f280f19e1de7ced375ab0b31dbd2ffe49ed2684ecb140918d662d58ff

  • SHA512

    fcd8197173da2c475451f500cbea32b446d872a8553ebd76dae4ac3873ed8da149e8036cad65968f10d6719992e442e0ddfb458ce250c41521668d5117a14ec4

  • SSDEEP

    49152:S9GUKQbhUbLP/WdzmmVoNyQNKXVTHUt0ONKgDGsbolFjeTXbjuOvtXcUwowyr4T5:yUbLPudCfUj0t0ON/GUW6lJ3HdjX0

  Score

  10^/10

  quasaroffice04discoveryexecutionspywaretrojan

  • Quasar RAT

    Quasar is an open source Remote Access Tool.

    trojanspywarequasar

  • Quasar family

    quasar

  • Quasar payload

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Command and Scripting Interpreter: PowerShell

    Using powershell.exe command.

    execution

  • Suspicious use of SetThreadContext

  behavioral1behavioral2