Extracted

• • Target

    JaffaCakes118_85a399a1ad036d5b526aff903b02f0e5

  • Size

    6.3MB

  • MD5

    85a399a1ad036d5b526aff903b02f0e5

  • SHA1

    8dfc263a69a4e2d9ec875966cf6086683ad7494c

  • SHA256

    ad5fd2c369c089a0d2c66ffd7a3e6977f7a82ae119ff272bc349db393d0d5588

  • SHA512

    9093e87f7e9e05d33a65cfeb3f7f56f26c991d1675d01bd596572750b7b99591aea5d9d3528b4ca66f8895ad87751a8a36865496667f499d0665d1b99d58a192

  • SSDEEP

    98304:9nTOXv3hcHp5ooEAnHRVN07KgHDpS18DqBRe7qxKfT1J+tNY3LU4rI2qo/:lTWxg53HRVu7vHDpS1IqBRU7kCs2q

  Score

  10^/10

  quasarworddiscoveryevasionspywarethemidatrojan

  • Quasar RAT

    Quasar is an open source Remote Access Tool.

    trojanspywarequasar

  • Quasar family

    quasar

  • Quasar payload

  • Identifies VirtualBox via ACPI registry values (likely anti-VM)

    evasion

  • Checks BIOS information in registry

    BIOS information is often read in order to detect sandboxing environments.

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Themida packer

    Detects Themida, an advanced Windows software protection system.

    themida

  • Checks whether UAC is enabled

    evasiontrojan

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  behavioral1behavioral2