Extracted

• • Target

    lol.exe

  • Size

    4.9MB

  • MD5

    1958ebce3ce234f5bc991d75bbeac04d

  • SHA1

    a3a65a551398e3c81ecb8f4729ea4f879e018ea4

  • SHA256

    8961760a99a872da1ba6555b2eafaa8e68dfce94136156fff0651ac61275acf5

  • SHA512

    c99210237ac3135c9f75eeafe4803b129d0f7749c3960a8d127e4c28f982c8ecf61672bcf358a5f76cc02bd5cc27ca9863ed9d24ca75242db9799aa84675ac9c

  • SSDEEP

    49152:DAodtaG9kS2U84B+FLan9k5TRM9zlfVjjotfsdS2Mc1xZ9mw53PvOL7CaI4LOOEl:h/B179A2Pbn2shvit4xAhQRxGck6lh

  Score

  10^/10

  quasarnmwdiscoveryexecutionspywaretrojan

  • Quasar RAT

    Quasar is an open source Remote Access Tool.

    trojanspywarequasar

  • Quasar family

    quasar

  • Quasar payload

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Drops file in System32 directory

  • Suspicious use of SetThreadContext

  behavioral1behavioral2