Extracted

• • Target

    Read-Me.txt

  • Size

    169B

  • MD5

    eaa6018aa11f6533cd4ce7ad9f32813d

  • SHA1

    a806f40b46eb875c3d524cd2bc38ec6faf843eb6

  • SHA256

    8d1e4273408e008d516a5c2ff96a38de3959adc71a49e7a5007774064a4e93f0

  • SHA512

    0e5dff3af21ef92e60a0d96224d6560be838ec8f71d9add63844ed224d42bf146f431d11d7a3c8a31ca4e0abd325d22a17731f930850684293ab51906298c0cb

  Score

  1^/10
  behavioral1behavioral2

• • Target

    burpsuite2.1.EXE

  • Size

    208.5MB

  • MD5

    bd85c0bcec470d54b3f697174fd733aa

  • SHA1

    9aa3c62a72495ad25db82d0215c2cce285952083

  • SHA256

    1ac62e3a8c0e4e3da8a0e8d33357597d8c6e52687783beb9b54caa4e1394655d

  • SHA512

    ec6fec4812e0717b21025839da039fb0627cdcbe6d199ef0e0d02530348385e2c535b7291b427d5dbfc5a349dcc45fd6405af35c5dfb23dcd90fcd000a4a5401

  • SSDEEP

    3145728:w4gxW5XbLm7Gf6tCgR7TE1bHGxVITiJdwnjMphAU3zVWA81w3LytJJ5QRrur6XyJ:w4OrRTgbHGkMdajmT18mgvSm6CZDxRH

  Score

  10^/10

  quasarloomisdiscoverypersistencespywaretrojan

  • Quasar RAT

    Quasar is an open source Remote Access Tool.

    trojanspywarequasar

  • Quasar family

    quasar

  • Quasar payload

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  behavioral3