Extracted

• • Target

    JaffaCakes118_5ba44ef6e4794a232ab680c01289ab13

  • Size

    3.0MB

  • MD5

    5ba44ef6e4794a232ab680c01289ab13

  • SHA1

    cbba30dd455680e31ecd27567e71f4d8459c9d1e

  • SHA256

    30e4bb6f6d78d8d66e9df4b8c856cc2877096c6851be7c167ed23dff72add67e

  • SHA512

    9968179e34f56e7b6b8c5b1618c0ce487a99228b0eb66aa48570fb0c5f3d6aa05b13038cfc4e4ce2815a153ab055d0070a1d0accb77935fe80a98db404d1efd5

  • SSDEEP

    49152:GJdbxFJNoyWQCrm1KKCYCBPCMtIDWk+oowRXN9CJTvAWd3OulJ/:yFTtWQT1vCYC8Wk+6FDDu3/

  Score

  10^/10

  quasarrotazdiscoveryexecutionpersistencespywaretrojan

  • Quasar RAT

    Quasar is an open source Remote Access Tool.

    trojanspywarequasar

  • Quasar family

    quasar

  • Quasar payload

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Adds Run key to start application

    persistence

  • Checks system information in the registry

    System information is often read in order to detect sandboxing environments.

  behavioral1