Extracted

• • Target

    Lose2himatoBeta.exe

  • Size

    135.3MB

  • MD5

    15498caff53ec11af87a73319367838c

  • SHA1

    4a45433a0a513119418ed44f4c475151a43ba923

  • SHA256

    f962beec9703a522fae680c30ec2b7bc44565e431128bc46d1410e476b564962

  • SHA512

    aaa86e7258f11329cf9853d4dec64e7b891dc139fc8dd1133e2229b0987494ad4191d9663cc3cf5c90a4a99e8ccca86171d8b3c12f09885ca751e4bdd2fc2430

  • SSDEEP

    786432:zl5HNB9pAbrDMZBfPPgs9TFMd15DeSqVO0EQWW2IxEm+KoZd7APUF85n9wwTtLwd:J5HOsPfmZ0/EmREdEPUF85nSUgTX

  Score

  10^/10

  quasaroffice04defense_evasiondiscoveryevasionransomwarespywaretrojan

  • Quasar RAT

    Quasar is an open source Remote Access Tool.

    trojanspywarequasar

  • Quasar family

    quasar

  • Quasar payload

  • Grants admin privileges

    Uses net.exe to modify the user's privileges.

  • Disables Task Manager via registry modification

    evasion

  • Indicator Removal: Network Share Connection Removal

    Adversaries may remove share connections that are no longer useful in order to clean up traces of their operation.

    defense_evasion

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Legitimate hosting services abused for malware hosting/C2

  • Drops file in System32 directory

  • Sets desktop wallpaper using registry

    ransomware
  behavioral1behavioral2