Extracted

• • Target

    ffa58ebc168e4a19c311097b97645a5d8801db2326f4e8784b634c3e2e2de991.exe

  • Size

    1.4MB

  • MD5

    c28ef8671a7f140f9385ab177e38844b

  • SHA1

    4cc35c23f2ce252413249ecd2ea47967fc00d5a4

  • SHA256

    ffa58ebc168e4a19c311097b97645a5d8801db2326f4e8784b634c3e2e2de991

  • SHA512

    6ce012bf3c1024eef4a47f54c86e3819175816d6c39bfa2216d1d522fc9612637473d8c6be2f4f203f52fc38c2bf887ed6e748ff5c18ee960fb0d82014ade82a

  • SSDEEP

    12288:2fcOokxZ4FK9VlPprK7w5NljuDvdLwLEcXq8dxSaDygxpy3nZOJcllvB:2P8FMhQiXhxkKcOUv

  Score

  10^/10

  discoveryquasarchimspywaretrojan

  • Quasar RAT

    Quasar is an open source Remote Access Tool.

    trojanspywarequasar

  • Quasar family

    quasar

  • Quasar payload

  • Suspicious use of NtCreateUserProcessOtherParentProcess

  • Drops startup file

  • Suspicious use of SetThreadContext

  behavioral1behavioral2