Extracted

• • Target

    b8494a5132217091e54397571abe6d1ee07b4e136105b834b9dbf3c4edc8ee99N.exe

  • Size

    5KB

  • MD5

    dbfaaadeb507446fe65aa09ffc3570d0

  • SHA1

    84ee588f8db2217b56e3c20a13ecf161318c56ca

  • SHA256

    b8494a5132217091e54397571abe6d1ee07b4e136105b834b9dbf3c4edc8ee99

  • SHA512

    fd6d89450b312b26fda6070a5b14dedc801b7299c70f8a022a3fa17855650316e0ab0f9e6bb727ad058c8fd8a38e299926e78adadbda966e3312f818c2b1b1c8

  • SSDEEP

    96:AT6gFs60Dctksx+3NqjH+EsUbmPfAFzNt:4kz+ToN6eEsUyK

  Score

  10^/10

  discoveryquasarteamspywaretrojan

  • Quasar RAT

    Quasar is an open source Remote Access Tool.

    trojanspywarequasar

  • Quasar family

    quasar

  • Quasar payload

  • Suspicious use of NtCreateUserProcessOtherParentProcess

  • Drops startup file

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2