Extracted

• • Target

    b8955e1e7cb3acd7b1bcd6328c5e11969c5dbacd2162cd34f3afb73d7ba4b80f.exe

  • Size

    1.4MB

  • MD5

    e95f7184a33d6edeecd365f7ad93d11e

  • SHA1

    b9154f8ad3d068549617c7cd32bfade8ce2c5f09

  • SHA256

    b8955e1e7cb3acd7b1bcd6328c5e11969c5dbacd2162cd34f3afb73d7ba4b80f

  • SHA512

    7d85203949dc197766391e96c7638e2ee630043ac443ffc7ae271acfc70f29b5d748ac40eec8062705de23ab1545ad3abb642e3b890f87632b9ac36b84d24fa8

  • SSDEEP

    12288:b/bzOGnF/lx54LOaJleaqIs/eBj52DYWQNwF/zsjVODN/By:bmGLZmx5gYWRaYJ/w

  Score

  10^/10

  discoveryquasarmanspywaretrojan

  • Quasar RAT

    Quasar is an open source Remote Access Tool.

    trojanspywarequasar

  • Quasar family

    quasar

  • Quasar payload

  • Suspicious use of NtCreateUserProcessOtherParentProcess

  • Drops startup file

  • Suspicious use of SetThreadContext

  behavioral1behavioral2