Extracted

• • Target

    8d31eb458dbdd8c2a077e0f460af302e23d3101ef2b3244122bbd9f27a9cfdd8N.exe

  • Size

    1.3MB

  • MD5

    ad1762e0e5eef2a9e8c2e4b2e16642c0

  • SHA1

    35db306e48aa98e9186ce3205375bd9a09994636

  • SHA256

    8d31eb458dbdd8c2a077e0f460af302e23d3101ef2b3244122bbd9f27a9cfdd8

  • SHA512

    e98e3b50b2c3ed954bb180202690c3c6faea329ae6dd55b1612f5e02afb11fcc745c58307b25116de0070696efec1bc29fa3c8e9c574cbf57c0d74b09c7f3da5

  • SSDEEP

    24576:SXgzXWjsCGT27mq5qUSXvpVWK5OjKxAVMDJdNnb4INYKk:5Xos3qQUivHW8OjWA+DJdNnccYT

  Score

  10^/10

  discoveryquasarplumoraspywaretrojan

  • Quasar RAT

    Quasar is an open source Remote Access Tool.

    trojanspywarequasar

  • Quasar family

    quasar

  • Quasar payload

  • Suspicious use of NtCreateUserProcessOtherParentProcess

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Drops startup file

  • Executes dropped EXE

  • Loads dropped DLL

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Enumerates processes with tasklist

    discovery
  behavioral1behavioral2