Extracted

Extracted

• • Target

    dogger-qt-windows/dogger-cli.exe

  • Size

    2.0MB

  • MD5

    8ec0cb1a3536a41842c6c848187f01ed

  • SHA1

    4f99125bd35519eb52c8b1737823dfe5b1850663

  • SHA256

    b441b7395cc59ee0e692f9dca627853a4e09a32d59564be75d560620e36c9715

  • SHA512

    b966542a124e3a797505acb6697322c62d79ea0c9f031a5de61ed622c6bac32abc603d3254b48303fe4efcb13a79b43de065beebddcc6b754dad1bedbfeca428

  • SSDEEP

    24576:xLhAoAIccJD6wHRWAJ00gyX2xylirEuq4WlFFlfr9NxPmKn6RUySZ:VhAdchv05yX2x+RuDWrFlJPYRUyS

  Score

  1^/10
  behavioral1behavioral2

• • Target

    dogger-qt-windows/dogger-qt.exe

  • Size

    83.6MB

  • MD5

    3c607881c805adde0f4118f2fe5ea712

  • SHA1

    72182ea0e810c18edec5dcca85efc277a51b91e7

  • SHA256

    175a0366e2f3fa190b8f9a9a447f9b9efa679c36c394f3b8b0366e63c5df4cea

  • SHA512

    9ebd2294651cb792450b1005a8c77806234b0dba4cdd09a92e1e2460a7170f27c2139c36af3c36202530cf8a24ddbe26f3425e5849a8053881fa214359289bfd

  • SSDEEP

    393216:F4TPZVLWruiFVks+9j54GXvitZQLCO5SXDqQu58EISEhoIaE2FShABZDv25PPa2k:FKRVQxhu0P8Lq1LEvxOOx5Sq

  Score

  10^/10

  quasarsenshidogersenshidoggerdefense_evasiondiscoveryexecutionspywaretrojan

  • Quasar RAT

    Quasar is an open source Remote Access Tool.

    trojanspywarequasar

  • Quasar family

    quasar

  • Quasar payload

  • Suspicious use of NtCreateUserProcessOtherParentProcess

  • System Binary Proxy Execution: Regsvcs/Regasm

    Abuse Regasm to proxy execution of malicious code.

    defense_evasion

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Drops startup file

  • Executes dropped EXE

  • Loads dropped DLL

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Enumerates processes with tasklist

    discovery
  behavioral3behavioral4

• • Target

    dogger-qt-windows/dogger-tx.exe

  • Size

    3.6MB

  • MD5

    e26738feb17bc0eec9548a3fc831d89e

  • SHA1

    508d27b6d43d93b85a3088a954436efcfc95240a

  • SHA256

    cbdc3b3b4f12046d82892d5896c2dfdfec74afdd31a8fcd88591bf4a994895ac

  • SHA512

    c47e579be314bc54af0710f4c6e50155c6098bca5b63ee91ffa3ae0e34ddbcf1bc76f9e480bd7120d2eb11ea1b2ef832375afe9eb06356c1b744cef8f57d44c2

  • SSDEEP

    49152:zSgYFyeqz//DvplbcWPhAZ3n1kdXsHi1POi50f5ienWs0YGANMoywHhSC7LPz:zl1/DBaJumi5W2ANMoHHhrL

  Score

  1^/10
  behavioral5behavioral6