Extracted

• • Target

    5fr5gthkjdg71.exe

  • Size

    6.0MB

  • MD5

    13b0dec8a2c9291ec13ca9d0f1a98b33

  • SHA1

    762c7072179bce1822999dc30c6252262caf6c00

  • SHA256

    210673b54f64ba4504b4ffb778b245261ba47ba659bfe14cd66290bf9c0f64ba

  • SHA512

    b8b97a630c6f4eca602c756a5a1c29e1cc3354db29176a5b34cb92fd10b14665bde82d01f97c65fbdec3db343e20f6ec67a9e1d3db9c16c280f2e8962d144346

  • SSDEEP

    98304:j3GflC+i0bBHXGgjaQx+OhfzTxzdloaDU5BKtxo5fQIwuhkNUwZ:j3GtCj0bR2Ej1hbTxkfzKYAEkXZ

  Score

  10^/10

  quasar4drundiscoveryevasionexecutionpersistencespywaretrojan

  • Modifies security service

    evasion

  • Quasar RAT

    Quasar is an open source Remote Access Tool.

    trojanspywarequasar

  • Quasar family

    quasar

  • Quasar payload

  • Suspicious use of NtCreateUserProcessOtherParentProcess

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Creates new service(s)

    persistenceexecution

  • Sets service image path in registry

    persistence

  • Stops running service(s)

    evasionexecution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Power Settings

    powercfg controls all configurable power system settings on a Windows system and can be abused to prevent an infected host from locking or shutting down.

    persistence

  • Drops file in System32 directory

  • Suspicious use of SetThreadContext

  behavioral1behavioral2