Extracted

• • Target

    f1bedec9834e6b7457571b68587406b042b071cb244958afbbf4543b29c49759

  • Size

    3.5MB

  • MD5

    305b0cf01534c4efda55d1c2fae17fb0

  • SHA1

    13472d5c223b6279e94652a166799a8fb6dcf74f

  • SHA256

    f1bedec9834e6b7457571b68587406b042b071cb244958afbbf4543b29c49759

  • SHA512

    983995729e3441daa5beb4ce7827ca781af5b29e74bda7ae267665169c2501d32a5387ea93f1620d22d3ff9cfff21b9913c9f94f7071cd6c8fd03896f49aeb9a

  • SSDEEP

    98304:SgryDlzDAelXXs9ouzoWPqd3XkhegK12uYpHKBB:rrKmcWihVj16pqBB

  Score

  10^/10

  quasar5-11discoveryspywaretrojanstealer

  • Quasar RAT

    Quasar is an open source Remote Access Tool.

    trojanspywarequasar

  • Quasar family

    quasar

  • Quasar payload

  • Suspicious use of NtCreateUserProcessOtherParentProcess

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Drops startup file

  • Executes dropped EXE

  • Loads dropped DLL

  • Reads WinSCP keys stored on the system

    Tries to access WinSCP stored sessions.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Enumerates processes with tasklist

    discovery
  behavioral1behavioral2