Extracted

• • Target

    alyemenione.lnk

  • Size

    2KB

  • MD5

    12ca834e507ca967d01911cec7454312

  • SHA1

    2d43271a7ec861f87da9bdeced53bd9bb20986ff

  • SHA256

    9dd34887a7aa11ba28a8e63d484274110ab40a6ad7035f8ff93c19c12ec66542

  • SHA512

    b3033aab1d18a50957e698bf0dbdaa3e8245f1a74bc7129b486d1ee2f0c5164998603616b48cc67fd4e8cca7bcc40c36ca51e7a5ccf6c54fe02277615c9de4fa

  Score

  10^/10

  quasarp1discoveryexecutionpersistencespywaretrojan

  • Quasar RAT

    Quasar is an open source Remote Access Tool.

    trojanspywarequasar

  • Quasar family

    quasar

  • Quasar payload

  • Blocklisted process makes network request

  • Command and Scripting Interpreter: PowerShell

    Run Powershell and hide display window.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Adds Run key to start application

    persistence
  behavioral1behavioral2