Extracted

• • Target

    Helix.rar

  • Size

    5.7MB

  • MD5

    aa739d62f7cecb119d79c6dd20ce08dc

  • SHA1

    c08fc2fa7c60aaccaf63bc36b97718805aa0cf0c

  • SHA256

    0dfd21302019e4bfd87c80d5b8c02f2fd04e4468df4d1a2d3e9a79a60d6034f8

  • SHA512

    55d055ef27f95cd789b7db207e7d06110960b103f622be46c0852af8fa9b42f4fc442c013ef37facb21116cd084d5f7c11c67ae1fbfdbf2d19579449438d9eab

  • SSDEEP

    98304:pqVEctip61GQnWmL7RvzZ/Nf8g9KAywc7ebbPF4LE+cnZLK5lANp1P1NLGXN:pqliAGYf3/Nf99KArcKfPSbcn1dB19G9

  Score

  10^/10

  quasarexecutionpersistencespywaretrojan

  • Quasar RAT

    Quasar is an open source Remote Access Tool.

    trojanspywarequasar

  • Quasar family

    quasar

  • Quasar payload

  • Suspicious use of NtCreateProcessExOtherParentProcess

  • Suspicious use of NtCreateUserProcessOtherParentProcess

  • Command and Scripting Interpreter: PowerShell

    Run Powershell and hide display window.

    execution

  • Sets service image path in registry

    persistence

  • Checks BIOS information in registry

    BIOS information is often read in order to detect sandboxing environments.

  • Executes dropped EXE

  • Drops file in System32 directory

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  • Suspicious use of SetThreadContext

  behavioral1behavioral2