Extracted

• • Target

    OperaGXSetup (41).exe

  • Size

    3.8MB

  • MD5

    f6a94c99deff44303f682dd2bb7d3d12

  • SHA1

    f2c6fa65a69a67a3e2120cfbb61511a495c18688

  • SHA256

    28eb5915b45f87b4ff342dbfb0122757217e79277770e9fd06a6342009c56829

  • SHA512

    16edb4c4ef94a0e19088c69a3150fc2f0e158e707eb8a4a085d7e95eecde2fbdc4bdd1afbb3fc0b13d179d2a4e60f60de14a4224a998dfb6d944dea6441ec3ec

  • SSDEEP

    49152:ZVAbwA+j3AtriaXicL8D8nqdZqb8oM28CBHmLOIt/ZwDAakqbMz3Lnn7cAWFJJL:PA+jxJIfMKmLOIt/yDh7MbLnnXWFv

  Score

  10^/10

  quasaroffice04discoveryspywarestealertrojan

  • Quasar RAT

    Quasar is an open source Remote Access Tool.

    trojanspywarequasar

  • Quasar family

    quasar

  • Quasar payload

  • Executes dropped EXE

  • Loads dropped DLL

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  behavioral1