Extracted

• • Target

    Tiny v0.2/Tiny.exe

  • Size

    618KB

  • MD5

    b9f7f125066c414f71fb9b805879a4cf

  • SHA1

    e7a5ea344304f289029d031b012a680b689aa7d1

  • SHA256

    d944181cf3c1dc7b02d30d4802d491a99f42a181446ce1be7710724541210c7d

  • SHA512

    4bd845189e56aaa0ff55a321372ff7b3ab6cf68a272787371c014f70831eca56d6b03365a4f8589b1f3b55a083c8d908e9cb9f6167ac868113354d9ca436433f

  • SSDEEP

    12288:ILEddxz9C1r0twaY0lmJZdwA8mRARNC+y9ErlfSu:KE/XFA4pAARNCvulfSu

  Score

  10^/10

  quasaroffice04discoverypersistenceprivilege_escalationspywaretrojan

  • Quasar RAT

    Quasar is an open source Remote Access Tool.

    trojanspywarequasar

  • Quasar family

    quasar

  • Quasar payload

  • Event Triggered Execution: Component Object Model Hijacking

    Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.

    persistenceprivilege_escalation

  • Executes dropped EXE

  • Loads dropped DLL

  • Modifies system executable filetype association

    persistence

  • Adds Run key to start application

    persistence

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Drops desktop.ini file(s)

  • Legitimate hosting services abused for malware hosting/C2

  • Checks system information in the registry

    System information is often read in order to detect sandboxing environments.

  behavioral1