Extracted

• • Target

    Client-built.exe

  • Size

    348KB

  • MD5

    1b3caea7f3034ec10eecb722a369c652

  • SHA1

    7bf564e5695c879a823068f19b9c5b25d9c3ed53

  • SHA256

    4ca77febd10fb2e3a0ebd202ffd7efb798912d80c76ebdbc76b68b7b59de115a

  • SHA512

    96d59d9a0bca26121ea0643840a3c568fb5ee5fa21cb4e6278cb229ad9b34c9445c22f406daa3c8c11f84f30995064612a1e24eff3211878eae2fd5c5b81a646

  • SSDEEP

    6144:9MNHXf500ME3EaGbbJ23fR34sZh85r+UxRXNO:ud50LNqR3nh8l+UxRXNO

  Score

  10^/10

  quasarmeedodiscoveryspywaretrojan

  • Quasar RAT

    Quasar is an open source Remote Access Tool.

    trojanspywarequasar

  • Quasar family

    quasar

  • Quasar payload

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Legitimate hosting services abused for malware hosting/C2

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  behavioral1behavioral2