Extracted

• • Target

    a4e04fcc301833211359e575150cc7cc_JaffaCakes118

  • Size

    656KB

  • MD5

    a4e04fcc301833211359e575150cc7cc

  • SHA1

    815d3f4eb2029ec80408bea43fb1e1febadadaf6

  • SHA256

    d2d3f197a13bdd19a00bc0a2e1de1704f3103142d723b0a6a0ab522aa0bd4524

  • SHA512

    82ec43e69b86c26aec4f2b22e25301259f9ec00fdb1e9b3c67699a71dac04d1b6148f1a01f0922832b99d631ae5e292cf020a6e0054ddaf056a25b1b49add376

  • SSDEEP

    12288:k5bTxmvjcBEEnpMuWtlVQOGKxWd1zmFCWNshg78cBhjr2JWH3Qx02U:6bTxmvjanpRy2K8d1zmI4shgP5rxHgxQ

  Score

  10^/10

  quasaroffice04wdiscoverypersistencespywaretrojan

  • Quasar RAT

    Quasar is an open source Remote Access Tool.

    trojanspywarequasar

  • Quasar family

    quasar

  • Quasar payload

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1behavioral2