Extracted

• • Target

    celex.exe

  • Size

    3.1MB

  • MD5

    e97bf71664c901e2dd3b02c158d14cc7

  • SHA1

    75827ff9fefcd7bab397d6a7af15f3093e38d1c6

  • SHA256

    85af420868f937e1d70898ef30664bb62cf3da9eea467191d407eb1f418a67b7

  • SHA512

    532b0dcb2027cafb2a568c692360589d855b8c36bcd22b7dfb92c7b71b437e03dc26a55da0c3d0163b3286b9b63980e30d5ebb4d7e5fa6dd2ed3f1aba5f09476

  • SSDEEP

    49152:PvmI22SsaNYfdPBldt698dBcjHpuxNESENk/iJLoGd51THHB72eh2NT:Pvr22SsaNYfdPBldt6+dBcjHMxgZ

  Score

  10^/10

  quasarskidspywaretrojanstealer

  • Quasar RAT

    Quasar is an open source Remote Access Tool.

    trojanspywarequasar

  • Quasar family

    quasar

  • Quasar payload

  • Executes dropped EXE

  • Reads WinSCP keys stored on the system

    Tries to access WinSCP stored sessions.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  behavioral1behavioral2