Extracted

Extracted

• • Target

    vers2.0.0-installx64.exe

  • Size

    3.6MB

  • MD5

    62af7389396c21b283d8655e7562d106

  • SHA1

    c54841ab13b60aaf222b926f787c8669564a8090

  • SHA256

    da320fb9d212b7d38eb28a54e1283bb4e9546ee5009540f46aff61083fecbed0

  • SHA512

    9967b67006ba3a4ec6c13025b84ba42a112ccce4c38040f3849b001d39d27febf746f6e46e6a2673f3769fdbc4dff94f722fe5593e06d6ee82c176619b7e75c3

  • SSDEEP

    98304:9EmUsgCgxpVbU/g6+WJdDldtYqdqbqjom6/JfS1:WVbU/gAhdtYqAgkJfS

  Score

  10^/10

  quasarxwormchxmpdiscoveryratspywaretrojan

  • Detect Xworm Payload

  • Quasar RAT

    Quasar is an open source Remote Access Tool.

    trojanspywarequasar

  • Quasar family

    quasar

  • Quasar payload

  • Xworm

    Xworm is a remote access trojan written in C#.

    trojanratxworm

  • Xworm family

    xworm

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Drops startup file

  • Executes dropped EXE

  • Loads dropped DLL

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  behavioral1behavioral2