Extracted

• • Target

    e05b6849f06853651630e79b77c52d8ca886299047d79e6ee2ace928d2105758N.exe

  • Size

    637KB

  • MD5

    f1c3e7d4f2ea34ded96047cc76392340

  • SHA1

    60683db56a96afe8ef1557c10fb861ae1081097b

  • SHA256

    e05b6849f06853651630e79b77c52d8ca886299047d79e6ee2ace928d2105758

  • SHA512

    9d8cf3b1bc0bb153a364618f0e1038a87549ce9d3c89ae4fd65c24737cb1a07f31a8618fdbb7d66ef9f2e410e3616593f7ba2e2ec4fa1325b8f86147956d4e47

  • SSDEEP

    12288:PFUNDaJTEgdfYe/iKg3qFE4/ywNFpdrdwzTCcdjv:PFOaKUwC5F9ywNFpdJ7cdjv

  Score

  10^/10

  quasaroffice04discoveryevasionpersistencespywaretrojan

  • Modifies visiblity of hidden/system files in Explorer

    evasion

  • Quasar RAT

    Quasar is an open source Remote Access Tool.

    trojanspywarequasar

  • Quasar family

    quasar

  • Quasar payload

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • Drops file in System32 directory

  behavioral1behavioral2