Extracted

• • Target

    a8f8595e1b3174a4cc26bde2e09cbd02319fe2a5588af2143af336a6d091107a

  • Size

    5.8MB

  • MD5

    7f4092487f658020d13296690668d937

  • SHA1

    4c2e7041e90f7f651c3f514f092260fdf38d23e4

  • SHA256

    a8f8595e1b3174a4cc26bde2e09cbd02319fe2a5588af2143af336a6d091107a

  • SHA512

    bf24517138ae37ad6dbb5aec2272b0db9a7aa9c38e8b1928a4e6223c624592bf2fff2ce27e3971329bd829667cfd5722ce1906b55ebb779b421bd8ec3aae749b

  • SSDEEP

    98304:VdAle+Q5MpCOKdEJFZPG+chrvWREYJSqKpwR5agwxo7CH+TY9PcFO3y9jmKn+HBT:bkgMpCOL++KYMqDbSVdRf3y9jKH+U

  Score

  10^/10

  quasarxxxnewsgroupdirectdiscoveryevasionspywaretrojan

  • Quasar RAT

    Quasar is an open source Remote Access Tool.

    trojanspywarequasar

  • Quasar family

    quasar

  • Quasar payload

  • Looks for VirtualBox Guest Additions in registry

    evasion

  • Looks for VMWare Tools registry key

    evasion

  • Checks BIOS information in registry

    BIOS information is often read in order to detect sandboxing environments.

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Maps connected drives based on registry

    Disk information is often read in order to detect sandboxing environments.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2