Extracted

• • Target

    Client-built.exe

  • Size

    348KB

  • MD5

    e8ecdeb99f70e49718a4fc9986f86df3

  • SHA1

    4f50bde0200a60dfe74a957a4f927e5648e2e78f

  • SHA256

    d0030ab6b4ed701eca6cad94f123517f564edb6a17ca33cbe6415cea10ac1401

  • SHA512

    f04bbab81c20eb22315914d20fa3d34761e0821592189b12c8821b311a3056f9c767bfc57eb41403c55a5eeb0cef50575686c1766ccfb164c5bb1892637c37ba

  • SSDEEP

    6144:SRNHXf500Mr7ULWRbNlPyDg+Rve9cc6i0pzci:Kd50xUxs+RWGcdOzci

  Score

  10^/10

  quasartestdiscoveryspywaretrojan

  • Quasar RAT

    Quasar is an open source Remote Access Tool.

    trojanspywarequasar

  • Quasar family

    quasar

  • Quasar payload

  • Executes dropped EXE

  • Loads dropped DLL

  • Legitimate hosting services abused for malware hosting/C2

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Drops file in System32 directory

  behavioral1behavioral2