Extracted

• • Target

    b09a68a8eaba5733bc3360d2af861b11_JaffaCakes118

  • Size

    410KB

  • MD5

    b09a68a8eaba5733bc3360d2af861b11

  • SHA1

    e0798d19c3def61bffb06825386bdfe4843f0eb5

  • SHA256

    723a593dc06b41d05ff387de35103e61c0a7d3c08cb935b8698a4f926e17b435

  • SHA512

    c24d1edeb4e8e0ff89cab31c4f014688682afc3e858d5a59f8bb3e642270160a78816283c5d5fd2aa885c158b4efb3a0d3d6c01e5ff450085238522baa81d1cc

  • SSDEEP

    6144:Bhnz0kWRGSiPJJXzQ8+9uzvVBiZglHS7peiE+RN3XIZPHlANZ4Go8NVZW5nrdZf2:IkWRL9sRlHqp9SlpGtZW5rdtQk8

  Score

  10^/10

  discoveryquasarnetpersistencespywaretrojan

  • Quasar RAT

    Quasar is an open source Remote Access Tool.

    trojanspywarequasar

  • Quasar family

    quasar

  • Quasar payload

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Adds Run key to start application

    persistence

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2