Extracted

• • Target

    ba59fb813ff718db8a17c4e5d244793d2199383969843ad31d09727b5e5ff156.exe

  • Size

    3.1MB

  • MD5

    a813f565b05ee9df7e5db8dbbcc0fa43

  • SHA1

    f508e738705163233b29ba54f4cb5ec4583d8df1

  • SHA256

    ba59fb813ff718db8a17c4e5d244793d2199383969843ad31d09727b5e5ff156

  • SHA512

    adb431c372c2e1d0f6019bedefe16a2253fcf76929ba7e2b9f9cc7a253137920615121a1a64f7003a43f39e8b17ace233daca32b2933b6953aa6cf558b834e2e

  • SSDEEP

    98304:aydj2yMy5en93hlLLzJjVrv3zs9Yv+Wcvy:pLYvzs9Yv+Wcv

  Score

  10^/10

  quasaroffice04discoveryspywaretrojan

  • Quasar RAT

    Quasar is an open source Remote Access Tool.

    trojanspywarequasar

  • Quasar family

    quasar

  • Quasar payload

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  behavioral1behavioral2