Extracted

• • Target

    bf07e9ac79ed258fa40f5c00e1b06e88a7648926f9351f4b860352a7d8a1f7abN.exe

  • Size

    876KB

  • MD5

    96ada2b7d27c62da2635104a0b1d71d0

  • SHA1

    8730396d2c4adcb2b2531ca207d3338604622f15

  • SHA256

    bf07e9ac79ed258fa40f5c00e1b06e88a7648926f9351f4b860352a7d8a1f7ab

  • SHA512

    1084cd57f87c6610897711f2107705d9fdfacb402a9ca4cf8624c04d00d6c04cbeb239b6945484387f22e500d8afcda090379bc25f659b0f0b9fd111422b4215

  • SSDEEP

    24576:weKxzRSGSL0v0mMO5PKDRwszHMC8hrAaRKG:BKxVpSL0AiyDysAC8hrZ

  Score

  10^/10

  quasaraoydiscoveryspywaretrojan

  • Quasar RAT

    Quasar is an open source Remote Access Tool.

    trojanspywarequasar

  • Quasar family

    quasar

  • Quasar payload

  • Executes dropped EXE

  • Loads dropped DLL

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2