Extracted

• • Target

    5182c93d80ab847541599124d388613c23bfb193b7879f5395b421bba5c568f6

  • Size

    3.7MB

  • MD5

    cd765738ca380479232b3742bec4681a

  • SHA1

    72183452d01eabefa4a1dc4e4702df04aca6da4e

  • SHA256

    5182c93d80ab847541599124d388613c23bfb193b7879f5395b421bba5c568f6

  • SHA512

    047266f5d2f30661857c501c705a18128082551498351eee28600bfb051e276535e00abfa0dd30acbcdb01e9238958f06ca934abb094ee03666cae51475ed6f5

  • SSDEEP

    49152:sBe/wR+kPCndafDZ7MTpxKQ4vWcucxZIp6/Y6HhxVetUw5WxGea2rkoVAAVsK5Iw:/namVxrcxys/XhxsuwEUeFzyRM

  Score

  10^/10

  discoveryexecutionquasarcodespywaretrojan

  • Quasar RAT

    Quasar is an open source Remote Access Tool.

    trojanspywarequasar

  • Quasar family

    quasar

  • Quasar payload

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Suspicious use of SetThreadContext

  behavioral1behavioral2