Extracted

• • Target

    5b41a8ac5a68ab33e4891ea03533e8ea650c16dd669d277decae2f00217a1e4d.exe

  • Size

    3.1MB

  • MD5

    fa5f99ff110280efe85f4663cfb3d6b8

  • SHA1

    ad2d6d8006aee090a4ad5f08ec3425c6353c07d1

  • SHA256

    5b41a8ac5a68ab33e4891ea03533e8ea650c16dd669d277decae2f00217a1e4d

  • SHA512

    a3b898f758060f124c443422c6dc88ba80d9892890b25d21e37a1d3947cd4b9dbef403382ee6e28c1007785a63c5fa387f7d00403db433eb59c03d0b2a88b50e

  • SSDEEP

    49152:evkt62XlaSFNWPjljiFa2RoUYIYiaJpFZwk/zLoGdWr1THHB72eh2NT:ev462XlaSFNWPjljiFXRoUYIlaj

  Score

  10^/10

  quasaroffice04discoveryspywaretrojan

  • Quasar RAT

    Quasar is an open source Remote Access Tool.

    trojanspywarequasar

  • Quasar family

    quasar

  • Quasar payload

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  behavioral1behavioral2