Extracted

Extracted

Extracted

• • Target

    Foto DC.png

  • Size

    1.4MB

  • MD5

    0ab308fbdda54c8fd7c04b7e0c0fffb4

  • SHA1

    7a0bbe6f6f943e97fc47224505587549c7d6df1d

  • SHA256

    0565d80022e4035fe21f5fa489a866fe24b9bbcd58e68a82f61df89aec623ee8

  • SHA512

    5866b071e8838a5d4b6e31bf01d70acbefb70a2ee3d6f9ffd9b1e820f5d2e27f2c1fef33c0f517025df4b8bbad9d9928f913a4fbe0ed634a6d0f5c6d89030437

  • SSDEEP

    24576:kvghhDIDQ57xL24Vr62E1KOvCG2USqro2F5HGa3chp0tRPb64GHwxnt:OwDI857xL24OKOv+Zqc2F5MhpQRPG4GS

  Score

  10^/10

  quasaroffice04discoveryspywarestealertrojan

  • Quasar RAT

    Quasar is an open source Remote Access Tool.

    trojanspywarequasar

  • Quasar family

    quasar

  • Quasar payload

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Reads WinSCP keys stored on the system

    Tries to access WinSCP stored sessions.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Legitimate hosting services abused for malware hosting/C2

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  behavioral1