Extracted

• • Target

    burpsuite2.2.EXE

  • Size

    208.5MB

  • MD5

    e65eadc039a63720027b5806936bb1f6

  • SHA1

    608d8d9ef45b0bf71257078ca8a68bcd5fe1ec49

  • SHA256

    99df601daf636cfc09df2eeceb7a9bcbb98c0798eac147f379cfcb2c2853d69c

  • SHA512

    d113f24f4be83c71142df7a19c0c67da89a7e79286692621c8da03f30c0ec18ff2e4dd6957d5a8c7b3e05354cb26428a873fc04909ceb5800e5ef9021126bcd1

  • SSDEEP

    6291456:ZY6l+mOWCkh3PjGl8bJcA8HKWEuxp5HT:m6l+mO6tPKMJUqWEuxv

  Score

  10^/10

  quasarsystemsomdiscoverypersistencespywaretrojan

  • Quasar RAT

    Quasar is an open source Remote Access Tool.

    trojanspywarequasar

  • Quasar family

    quasar

  • Quasar payload

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  behavioral1