Extracted

• • Target

    7e3c88b63ad3aa607cc07c79c05075eec2832c9a4ccb03e0005620759081f31f

  • Size

    288KB

  • MD5

    80738ce6e30247c37ee36568c43c8a5f

  • SHA1

    23e857927a17559cff000d3cde52d2fdf4b99cc9

  • SHA256

    7e3c88b63ad3aa607cc07c79c05075eec2832c9a4ccb03e0005620759081f31f

  • SHA512

    ea2a6a84ac11eb7631fb04c8fb6c30aa3aa3238dae674bfee5e859296a0f3f25e0ef9d44ee7b3550c9cae44323363e16d882d5be1b305e19408e0a2d05b24c48

  • SSDEEP

    6144:k7zO0LSclT6FOwEP5Kq+SMv0VGb7bDcllbkvn:alJtTF9zVGkllbk/

  Score

  10^/10

  quasaroffice04discoverypersistencespywaretrojan

  • Quasar RAT

    Quasar is an open source Remote Access Tool.

    trojanspywarequasar

  • Quasar family

    quasar

  • Quasar payload

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Drops file in System32 directory

  behavioral1behavioral2