Extracted

• • Target

    7842454c707050024b8c0c9d404b2c899eb3113b6cedd6440dbb4a8c1edc8ded.exe

  • Size

    4.8MB

  • MD5

    801303f345e4790e5360787751642a08

  • SHA1

    ee78b821317d1d68a995cd910cebca712362a4ce

  • SHA256

    7842454c707050024b8c0c9d404b2c899eb3113b6cedd6440dbb4a8c1edc8ded

  • SHA512

    495c440aecd70e880b5bb0dd510fcd99949afec14c2abbaa4ccaf2ffd10abb56cd67a3a478ca385710fa0525463cbf971b8b510d4f775efb91bb1e045992ea4f

  • SSDEEP

    98304:j3GccrcRznayXbOokuicn7TfKoJ5h7a5UgiLTAGSTqzG/jI39vBVszxKu:j3G6RzntKHk7TCoVaDiLcgzOUZByz8u

  Score

  10^/10

  discoveryexecutionquasar4drunevasionpersistencespywaretrojan

  • Modifies security service

    evasion

  • Quasar RAT

    Quasar is an open source Remote Access Tool.

    trojanspywarequasar

  • Quasar family

    quasar

  • Quasar payload

  • Suspicious use of NtCreateUserProcessOtherParentProcess

  • Blocklisted process makes network request

  • Command and Scripting Interpreter: PowerShell

    Run Powershell and hide display window.

    execution

  • Downloads MZ/PE file

  • Stops running service(s)

    evasionexecution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Power Settings

    powercfg controls all configurable power system settings on a Windows system and can be abused to prevent an infected host from locking or shutting down.

    persistence

  • Drops file in System32 directory

  • Suspicious use of SetThreadContext

  behavioral1behavioral2