Extracted

• • Target

    dd9597fa53774b4c390543d13cd559d0d5223e1d4e3207b4ca5dd90acff8dbbd.exe

  • Size

    1003KB

  • MD5

    3e52270d58f81602e1004c6b4f72098f

  • SHA1

    c9b006dbcee2d2faa333cc1b3b2a4c47419f697d

  • SHA256

    dd9597fa53774b4c390543d13cd559d0d5223e1d4e3207b4ca5dd90acff8dbbd

  • SHA512

    7926b744b212a02a5c90242e58bc6f6ee7864d16c523569e2f8d2577dcbc30ee70fd0712cea00892e1e122991b6f283edb40182bdd106b280f723ed4092606d8

  • SSDEEP

    24576:NGd7ccE0a+UXGSafMOjDs3Cb94oKnCV8LvxXa0qOvOZth:QAcE0a7X2MOTanCV8LdrqcQh

  Score

  10^/10

  discoveryquasarofficespywaretrojan

  • Quasar RAT

    Quasar is an open source Remote Access Tool.

    trojanspywarequasar

  • Quasar family

    quasar

  • Quasar payload

  • Suspicious use of NtCreateUserProcessOtherParentProcess

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Drops startup file

  • Executes dropped EXE

  • Loads dropped DLL

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Enumerates processes with tasklist

    discovery
  behavioral1behavioral2