Extracted

• • Target

    dc6032bb4d1d30872419a285faf9e3cc8829d6b826151b61317e85cb5e0cec83

  • Size

    1.3MB

  • MD5

    092a56d2ffbc62dad8d8a3864fd046fe

  • SHA1

    e90b1e199a1df28a2b748340b3a90a3e6112c058

  • SHA256

    dc6032bb4d1d30872419a285faf9e3cc8829d6b826151b61317e85cb5e0cec83

  • SHA512

    f6215dfd153385b49bf7b2cdb95bc45a2fb45be4ee295448d1bea946199e660ebcb920746388262e05405dc239478f1d4b156bbb03f66c0fb1702df88fba5470

  • SSDEEP

    24576:6gZml969wUGPr2uGKFzFTSpkPNnJJUwEbkWppzscd1:65769PaFTFNn/Uwyzppz

  Score

  10^/10

  quasarpc01defense_evasiondiscoveryspywaretrojan

  • Quasar RAT

    Quasar is an open source Remote Access Tool.

    trojanspywarequasar

  • Quasar family

    quasar

  • Quasar payload

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Indicator Removal: File Deletion

    Adversaries may delete files left behind by the actions of their intrusion activity.

    defense_evasion

  • Drops file in System32 directory

  behavioral1behavioral2