Extracted

• • Target

    RFQ9-XTC-204-60THD.xlsx.exe

  • Size

    143KB

  • MD5

    c9951fb84a416c1f329b39b2da482348

  • SHA1

    e250949b96260df94f7c4cce9ef009069690ffe6

  • SHA256

    de6b367a4b3a81fea07cdaa9406b9b70a994581cfae539f5da441268e4be4188

  • SHA512

    1e450fc3fff15facd76ce9ac643e2e0ef2ffad6e18ba54dd70f93968fc984d14f81f8429409ddf25320a2d80df6e240367b2dd49e4793acad2460c158e62c556

  • SSDEEP

    3072:IODxM5DNveAHHY+axlCTo0JLsLbJo9LdtxAuAqdES0m5kJ8QvT5+hM94K2icI7y:IO9M5DNveAHHY+clCU0JLsLb+9LdtxAN

  Score

  10^/10

  discoveryquasarchispywaretrojan

  • Quasar RAT

    Quasar is an open source Remote Access Tool.

    trojanspywarequasar

  • Quasar family

    quasar

  • Quasar payload

  • Suspicious use of NtCreateUserProcessOtherParentProcess

  • Drops startup file

  • Suspicious use of SetThreadContext

  behavioral1behavioral2