Extracted

• • Target

    832c978576aca4163e3c3127e622316794836b1e634b4128797fc9493ff57105

  • Size

    3.2MB

  • MD5

    a385e16864e1ac30f23dd08e87b93319

  • SHA1

    987c3448486e401936e928abc52cf80780fb2d37

  • SHA256

    832c978576aca4163e3c3127e622316794836b1e634b4128797fc9493ff57105

  • SHA512

    e2099df125c1ca9dfbaddd6ec89dadf94fcce7dd8c298958a53a8b0d0e52d91c0b26f8d1746ec72d5527594d678ec19c29f4849994d268fbdb6200a5c13c7699

  • SSDEEP

    49152:tgviI22SsaNYfdPBldt698dBcjHq1SQoGv5lpTHHB72eh2NTf:mvv22SsaNYfdPBldt6+dBcjHq19x8

  Score

  10^/10

  quasaroffice04discoveryevasionpersistencespywaretrojan

  • Modifies visiblity of hidden/system files in Explorer

    evasion

  • Quasar RAT

    Quasar is an open source Remote Access Tool.

    trojanspywarequasar

  • Quasar family

    quasar

  • Quasar payload

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • Drops file in System32 directory

  behavioral1behavioral2