Extracted

• • Target

    FortniteAim.exe

  • Size

    37KB

  • MD5

    5261f9f9d7b3f23de05daa9832f4a278

  • SHA1

    3c790285c1462f1c513539fb2616ac2c5c91065d

  • SHA256

    a749a50405c8bf369db729136cff6f063df776dc9e8658d3cb50af1653691bba

  • SHA512

    78c4c92c5b999edbecfe42258ff88daff7520bbaf890a07a5c7abfdd4ca58f422d1e5acb54dba92dc698d54d50687c35c11c895e66280b63a14fe263b557d4b9

  • SSDEEP

    384:8Lru2Pp7xeHnMnE9WNMrF6CsoEfvnDLf/oIURAfKAB6y6hTVk3QNZe55/f1i8r2+:sxW6XFnDnUOp6h6Y0L1rfooBotfH7

  Score

  10^/10

  quasarruntime brokerevasionexecutionpersistenceprivilege_escalationspywaretrojanupx

  • Quasar RAT

    Quasar is an open source Remote Access Tool.

    trojanspywarequasar

  • Quasar family

    quasar

  • Quasar payload

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Downloads MZ/PE file

  • Modifies Windows Firewall

    evasion

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Drops file in System32 directory

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2