Extracted

• • Target

    497960e1fdb8af14899674be0c997f9858384261945dbb91e8b28ae0e174cb6f.exe

  • Size

    13.3MB

  • MD5

    0d6982311c8a21313994773c99380dfb

  • SHA1

    d8a6abfbdf3fe52598f570abeed3b272b10484bd

  • SHA256

    497960e1fdb8af14899674be0c997f9858384261945dbb91e8b28ae0e174cb6f

  • SHA512

    47b4c7f9a8a49ab067d4214d6cb73277bc56f7e671d3ef3c38ca8d845c65dbf2303e083294d71d68bf4348b87558141d4d3281d959d262efe56b29a87e5437c4

  • SSDEEP

    49152:Kqsm55NYMPrb/T7vO90dL3BmAFd4A64nsfJlFngTR55I7NLz1S:Kq95TUGPf

  Score

  10^/10

  quasarcom surrogatediscoveryevasionspywaretrojan

  • Contains code to disable Windows Defender

    A .NET executable tasked with disabling Windows Defender capabilities such as realtime monitoring, blocking at first seen, etc.

  • Modifies Windows Defender Real-time Protection settings

    evasiontrojan

  • Quasar RAT

    Quasar is an open source Remote Access Tool.

    trojanspywarequasar

  • Quasar family

    quasar

  • Quasar payload

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Windows security modification

    evasiontrojan

  • Drops file in System32 directory

  behavioral1behavioral2