Extracted

• • Target

    Client-built.exe

  • Size

    348KB

  • MD5

    2ba09f53e30ef8c5d76398627edc43d1

  • SHA1

    1fe3307b985972b457abcf9f2152164699afa208

  • SHA256

    e98b1dbab728749f570394ce8b74ec14fc323dcefdb7cabd6d93da22e7bffe9f

  • SHA512

    2a6f2da1f92b10cf7d244e744496777539b96e2d5ced8e6ac2a6ddaad96c5418b70e5d6639bafb4787c9d6dcecff00cb1edca0680584899be7a5808223af0a4c

  • SSDEEP

    6144:7bwb/c2L0tkuj4xcwYrbgkl8MQ/LlHvsrROO:HH2Le8x9YAkl4/LNvsQO

  Score

  10^/10

  quasarclintdiscoveryspywaretrojan

  • Quasar RAT

    Quasar is an open source Remote Access Tool.

    trojanspywarequasar

  • Quasar family

    quasar

  • Quasar payload

  • Executes dropped EXE

  • Loads dropped DLL

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Drops file in System32 directory

  behavioral1behavioral2