Extracted

• • Target

    emmasBackdoor.exe

  • Size

    2.9MB

  • MD5

    0266f80fe6efd3e3e4bd0363d17bcbde

  • SHA1

    b144914eb53d2e35e410be64d2db052d06d680df

  • SHA256

    6cffbcd23aeb7ea8c813cda4dad413b9c24d983c0fa6da03931b690b04502411

  • SHA512

    21174624b988b26d16ba96c57b65a0dd0c0fa02d5396ca29c5cc11851f7546a528e1343f3216b224f3deebb1e749ac1dfd02fc5485bf4a0dd5b6d0983c496ac8

  • SSDEEP

    49152:EwREDDMVBq77B4L8lXQn/zJNGJ7YTpZIn+lD2GgWinoaDFO/82:EwRE8q77B44+zJNN1aHNo2O/82

  Score

  10^/10

  quasaremmassubdiscoveryexecutionspywaretrojan

  • Quasar RAT

    Quasar is an open source Remote Access Tool.

    trojanspywarequasar

  • Quasar family

    quasar

  • Quasar payload

  • Executes dropped EXE

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Drops file in System32 directory

  behavioral1