Extracted

• • Target

    Lose2himato.exe

  • Size

    135.3MB

  • MD5

    30b32bc02534355b906a37951b458808

  • SHA1

    61eada367af3558e45c8583e174cdef13e68b93b

  • SHA256

    6f08d8eb4044dd872b38ff8d6a2b6e86efa9f7d777cb1b09e1f575bfed9467a2

  • SHA512

    8735788ded8836ac0b5be86356263cba2899367964ca8711a8d89b84cecf8c50be799274bfae5d4c6b8bc5d4dea7f04f836f10bf230041677c61977299887839

  • SSDEEP

    786432:zl5HNB9mAbrDMZBfPPgs9TFMd15DeSqVO0EQWW2IxEm+KoZd7APUF85n9wwTtLwG:J5gOsPfmZ0/EmREdEPUF85nSUgTI

  Score

  10^/10

  quasaroffice04defense_evasiondiscoveryevasionransomwarespywaretrojan

  • Quasar RAT

    Quasar is an open source Remote Access Tool.

    trojanspywarequasar

  • Quasar family

    quasar

  • Quasar payload

  • Grants admin privileges

    Uses net.exe to modify the user's privileges.

  • Disables Task Manager via registry modification

    evasion

  • Indicator Removal: Network Share Connection Removal

    Adversaries may remove share connections that are no longer useful in order to clean up traces of their operation.

    defense_evasion

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Legitimate hosting services abused for malware hosting/C2

  • Drops file in System32 directory

  • Sets desktop wallpaper using registry

    ransomware
  behavioral1behavioral2