Extracted

• • Target

    JaffaCakes118_5c843791f7a693c418b162ccd993b997

  • Size

    6.0MB

  • MD5

    5c843791f7a693c418b162ccd993b997

  • SHA1

    8d6770ecadac15c9665dcabe2e69b63d62e30a18

  • SHA256

    ccd4b2ba4cea6ac4ea648e58cbe9ca9cd48f512a1df7414cad6c9ff602c6c688

  • SHA512

    6c773e7c57c9d73fc26b88af8b7a4f5491a28eb3211fbc55b3597f660cc424790b44f054ef131b535509aea079a255e3af58240d65d6e29390be7b7b95ac468e

  • SSDEEP

    196608:6vzeNVog53HRVu7vHDpS1IqBRU7kCs2q:8a53xVu7vHhqBa4Cs

  Score

  10^/10

  quasarchromediscoveryevasionspywarethemidatrojan

  • Quasar RAT

    Quasar is an open source Remote Access Tool.

    trojanspywarequasar

  • Quasar family

    quasar

  • Quasar payload

  • Identifies VirtualBox via ACPI registry values (likely anti-VM)

    evasion

  • Checks BIOS information in registry

    BIOS information is often read in order to detect sandboxing environments.

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Themida packer

    Detects Themida, an advanced Windows software protection system.

    themida

  • Checks whether UAC is enabled

    evasiontrojan

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  behavioral1behavioral2