Extracted

Extracted

• • Target

    6cf6ade8237b2c7d401b8aea07fedfa070f2d7fd7e34bde673632fe9250fa9a5N.exe

  • Size

    3.3MB

  • MD5

    94fafb9c5bad9356529fb599f4bf4260

  • SHA1

    7bbcc6309c587db43d8fef972eefc4bf27c98de1

  • SHA256

    6cf6ade8237b2c7d401b8aea07fedfa070f2d7fd7e34bde673632fe9250fa9a5

  • SHA512

    55f7e92bc321e6dbf14594a273fcc5c9046f8e2ae13196fd9caed55acd0fc3be601c0e3eaa4f58e765e28e5cdccb7fa442e8f6c113779eb6cd7bbed67646f65d

  • SSDEEP

    49152:Jv+lL26AaNeWgPhlmVqvMQ7XSKEp+oMfHzoGdNCTHHB72eh2NTsr:JvuL26AaNeWgPhlmVqkQ7XSKEp+nE

  Score

  10^/10

  quasaroffice04spywaretrojanpersistence

  • Quasar RAT

    Quasar is an open source Remote Access Tool.

    trojanspywarequasar

  • Quasar family

    quasar

  • Quasar payload

  • Suspicious use of NtCreateProcessExOtherParentProcess

  • Suspicious use of NtCreateUserProcessOtherParentProcess

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • Drops file in System32 directory

  behavioral1behavioral2