Extracted

• • Target

    JaffaCakes118_f7bbf426b790e58d31c112ad57028727

  • Size

    3.0MB

  • MD5

    f7bbf426b790e58d31c112ad57028727

  • SHA1

    c6c6ad699c01445d76a5e72c1890a4c77614e77a

  • SHA256

    fbd232bef38a185689126a83412f660670babd5fcd67674c698c3af1d9ccdb12

  • SHA512

    3f35132aaf069d598b66d3d87122f85beda6762a7c849ef5a3d36fd98ffae6c60367f07ba32217155082e469bdd77b2c6c0dce7fbe268dc6a4381540ba731fea

  • SSDEEP

    49152:mhNG2xCF8FythJYb7T6jNCAaYGzIKuZaonz0XdetFkMKoW4pOXs:EXC6othq7WjNCduZaWnBOX

  Score

  10^/10

  quasarrotazdiscoveryexecutionpersistencespywaretrojan

  • Quasar RAT

    Quasar is an open source Remote Access Tool.

    trojanspywarequasar

  • Quasar family

    quasar

  • Quasar payload

  • Command and Scripting Interpreter: PowerShell

    Run Powershell and hide display window.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Adds Run key to start application

    persistence

  • Checks system information in the registry

    System information is often read in order to detect sandboxing environments.

  behavioral1