Extracted

• • Target

    01de053d9560d419f0b6c35dbddb1175eb1fd7a21450989332024b812d39c4c2.exe

  • Size

    3.7MB

  • MD5

    15f259b30ec72a5217144834f7f5b564

  • SHA1

    baed3fe7d059a497f856e263431ccd3872ef1ea1

  • SHA256

    01de053d9560d419f0b6c35dbddb1175eb1fd7a21450989332024b812d39c4c2

  • SHA512

    5e1148a9cf8008b7c38d067ec34e5c3bc7255341d114476532f8111ea2c3e654eb70b0a439aaaea22543576f09b9cec269f9b3414a6a24fc54b89c7c677c5f47

  • SSDEEP

    98304:ZrAsTIZbqqBQjwske/pCT66UNYekeWY0CE9:ZcCSL0ke/pO5ekeWtCE9

  Score

  10^/10

  quasardaviddiscoveryexecutionspywaretrojan

  • Quasar RAT

    Quasar is an open source Remote Access Tool.

    trojanspywarequasar

  • Quasar family

    quasar

  • Quasar payload

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Suspicious use of SetThreadContext

  behavioral1behavioral2