Extracted

• • Target

    intro.avi.exe

  • Size

    348KB

  • MD5

    d219d94cabaa00e5abffc599bdeef75d

  • SHA1

    123e511de20beab7bfa2bea5c2206422bc5e8241

  • SHA256

    3cc847687e60acda504fc35577f36eedd0bca559a4de915d6dd88db9178567d4

  • SHA512

    82dbb2484e3e42fcd6c3914da4ebfc540e135b8b57bf240a28a3e9fceb6409d8a9b1f9ca9b4bf545d05a10fd9b1672a2a6a05d963aaa33f4905e74cc1c068734

  • SSDEEP

    6144:0I6bPXhLApfpMMoDMWZVGZV+RzbLirAeMB2Wku:FmhApypOrAeMB2/u

  Score

  10^/10

  quasaruserdiscoveryspywaretrojan

  • Quasar RAT

    Quasar is an open source Remote Access Tool.

    trojanspywarequasar

  • Quasar family

    quasar

  • Quasar payload

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  behavioral1behavioral2