Extracted

• • Target

    a867e87d6f26d0f3eec8bfafb7baf6b5e3db22c962426ecb8e96b5826bfd9e72

  • Size

    3.5MB

  • MD5

    2cd4f099577ed75e92cdee860436db0c

  • SHA1

    a6ab341f7f8a8ab591673dfd024ec1de08f737ce

  • SHA256

    a867e87d6f26d0f3eec8bfafb7baf6b5e3db22c962426ecb8e96b5826bfd9e72

  • SHA512

    151ce1357a56c47836cf6680dc48d2a4abe44e2ece4ff6babb2cd7a6d33b15a11fcef059783ba2e3f1751925679338a818e3480be668fd509b0f7d96e8812bd6

  • SSDEEP

    98304:DQHsEgv9H3MaF4MlLXkffcuSBIZugz+utBaElCDuaL:DEgBVF3Fof0Bwj+uJ4qC

  Score

  10^/10

  quasar11-11discoveryspywaretrojanstealer

  • Quasar RAT

    Quasar is an open source Remote Access Tool.

    trojanspywarequasar

  • Quasar family

    quasar

  • Quasar payload

  • Suspicious use of NtCreateUserProcessOtherParentProcess

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Drops startup file

  • Executes dropped EXE

  • Loads dropped DLL

  • Reads WinSCP keys stored on the system

    Tries to access WinSCP stored sessions.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Enumerates processes with tasklist

    discovery
  behavioral1behavioral2