Extracted

• • Target

    Order88983273293729387293828PDF.exe

  • Size

    1.4MB

  • MD5

    9c23449ea828b1d7d4473aa70f86caa8

  • SHA1

    474136c0e6d3d7c00a2e4f1b1e41f831fbb6dcba

  • SHA256

    7c9b4c774fbf907cf1858ea31454992e16d6b6521f880fcd8a12433ce25b6b35

  • SHA512

    843a03c44436410ae67a56ca00e4f3c19461979f4211b848eadf0ca02641ec3ee13a38f38e03bc316e028aceaa7571e41d1163e7d0933fe0e12d28ea1fae0925

  • SSDEEP

    12288:Er0K/EsBQT93xj6mZw7Y/zLZefq5U6t1uxSxwOz7MIAvKcz9eoJEtww2LOB:ES3V1w8kzSGOzwFV93O

  Score

  10^/10

  discoveryquasarmanspywaretrojan

  • Quasar RAT

    Quasar is an open source Remote Access Tool.

    trojanspywarequasar

  • Quasar family

    quasar

  • Quasar payload

  • Suspicious use of NtCreateUserProcessOtherParentProcess

  • Executes dropped EXE

  • Suspicious use of SetThreadContext

  behavioral1behavioral2