Extracted

• • Target

    86e6a56d03817c4369a67631d7eeca99a0a9b6b7635a1d159c9bc2263d7abad6.exe

  • Size

    34KB

  • MD5

    9de372f748c4a9dd77ddbfb325c1a31d

  • SHA1

    bef15c9f755dd25031424a63a07ec5ec8199c92e

  • SHA256

    86e6a56d03817c4369a67631d7eeca99a0a9b6b7635a1d159c9bc2263d7abad6

  • SHA512

    2b7f936be2afd76990a65c5f32bba350ce2b96b9a9c14b14190bf2fa3bced04953787eb12b7f17e600e3a9000328fdfeea851373a21e16919c874964039a83d7

  • SSDEEP

    768:ZCB/mZMXnTgjjSxKSbG6d30tjRi2T5EXbOfq1lk7kbzP:ZIxTgh29d3KRXT5cbOt7knP

  Score

  10^/10

  quasarfontdrvhostdefense_evasionexecutionspywaretrojan

  • Quasar RAT

    Quasar is an open source Remote Access Tool.

    trojanspywarequasar

  • Quasar family

    quasar

  • Quasar payload

  • Blocklisted process makes network request

  • Downloads MZ/PE file

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself

  • Executes dropped EXE

  • Indicator Removal: File Deletion

    Adversaries may delete files left behind by the actions of their intrusion activity.

    defense_evasion

  • Drops file in System32 directory

  behavioral1behavioral2