Extracted

• • Target

    kreo q zi.exe

  • Size

    3.1MB

  • MD5

    28ac02fc40c8f1c2a8989ee3c09a1372

  • SHA1

    b182758b62a1482142c0fce4be78c786e08b7025

  • SHA256

    0fe81f9a51cf0068408de3c3605ce2033a00bd7ec90cc9516c38f6069e06433b

  • SHA512

    2cbf2f6af46e5fae8e67144e1ac70bc748036c7adb7f7810d7d7d9f255ccf5d163cce07f11fb6526f9ab61c39f28bdf2356cc315b19a61cd2115612882eab767

  • SSDEEP

    49152:7v+lL26AaNeWgPhlmVqvMQ7XSKsxRJ6wbR3LoGdGTHHB72eh2NT:7vuL26AaNeWgPhlmVqkQ7XSKsxRJ6K

  Score

  10^/10

  quasaroffice04credential_accessdiscoveryspywarestealertrojan

  • Quasar RAT

    Quasar is an open source Remote Access Tool.

    trojanspywarequasar

  • Quasar family

    quasar

  • Quasar payload

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Credentials from Password Stores: Windows Credential Manager

    Suspicious access to Credentials History.

    credential_accessstealer

  • Deletes itself

  • Executes dropped EXE

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  • Drops file in System32 directory

  behavioral1