Extracted

• • Target

    534280e154dc967612dc97e9d4273b6f69436d374203ab0d6181608b6cb02362.exe

  • Size

    3.1MB

  • MD5

    f67e6aafbd9c86771f11c05ae83ae83e

  • SHA1

    c9fe04c78139d000182d89f4dd013e647db64cc0

  • SHA256

    534280e154dc967612dc97e9d4273b6f69436d374203ab0d6181608b6cb02362

  • SHA512

    f5d5b09a92a3bc7ff862cf87c5a4285e2ada1ec4cb9d5b1467e358ad3678a2dfe6acd2f1819b7f9646f1ef5e038c9ffb295ef8a6590a75cdf911913a5edaf27a

  • SSDEEP

    49152:avht62XlaSFNWPjljiFa2RoUYI+Y6a95fQrk/1LoGdpTHHB72eh2NT:avL62XlaSFNWPjljiFXRoUYI8aB

  Score

  10^/10

  quasaroffice04discoveryspywaretrojan

  • Quasar RAT

    Quasar is an open source Remote Access Tool.

    trojanspywarequasar

  • Quasar family

    quasar

  • Quasar payload

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  behavioral1behavioral2