Extracted

• • Target

    1b701daded4124260a49040d83dec15c627b8e4a1a04dc378aae7fecfca3abf3.exe

  • Size

    3.2MB

  • MD5

    c28dc010fc5198442496bc07dd50cd5d

  • SHA1

    0f90a005815c2700a65ea85ae86f13a182cc11e6

  • SHA256

    1b701daded4124260a49040d83dec15c627b8e4a1a04dc378aae7fecfca3abf3

  • SHA512

    7c94bafa48db045a864a778a010a7d1d03204828bd103a86c1267732a51260b0e689a799cc7e95410ceedd1254fb91aa3f19f62efa3e41e40be645862a4e07e2

  • SSDEEP

    49152:IuvyI22SsaNYfdPBldt698dBcjH7BhSR1J/xoGdoTHHB72eh2NT:Iuvf22SsaNYfdPBldt6+dBcjH7BhSb

  Score

  10^/10

  quasarddnsdiscoveryspywaretrojan

  • Quasar RAT

    Quasar is an open source Remote Access Tool.

    trojanspywarequasar

  • Quasar family

    quasar

  • Quasar payload

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  behavioral1behavioral2