Extracted

• • Target

    6d6c9c719e2f757442374af378c343a7.exe

  • Size

    3.1MB

  • MD5

    6d6c9c719e2f757442374af378c343a7

  • SHA1

    a58a2aa6dae2dbdf64472614985cac2adce4eddb

  • SHA256

    444c97f6db0626069965d9e4ddb4bf315326954c51b123b3dc7d64084e7fb646

  • SHA512

    a3ef795e64b1d43ca300da97abc7d211e5987064c1c7cafa7a1dadcd1cb35902fb230f5b8e9a008ced4bc1d33573403bad2d99a4ccca9b6b749355110eb10210

  • SSDEEP

    49152:HwElUPhZwv68DkG17WlqTz5oqM/p7vGJfAHdkTHHB72eh2NT:HwYUPhZwv68DkG17WlqTzeqM/p6t

  Score

  10^/10

  quasaroffice04defense_evasionspywaretrojan

  • Quasar RAT

    Quasar is an open source Remote Access Tool.

    trojanspywarequasar

  • Quasar family

    quasar

  • Quasar payload

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself

  • Executes dropped EXE

  • Indicator Removal: File Deletion

    Adversaries may delete files left behind by the actions of their intrusion activity.

    defense_evasion
  behavioral1behavioral2