Extracted

• • Target

    Update.exe

  • Size

    413KB

  • MD5

    d0564fc7770410d9c9efddfe4318fe40

  • SHA1

    70e9c65c95ef79a8fb412d4b5baa747be19f358f

  • SHA256

    926ca6246cafb2f73a2a44325a1c2c9a5e136f109cf5fc1beecfe2611adc95e8

  • SHA512

    0dbad5c423b060dc3122c8b1d351e6fd519526de74ff01c17997e05ec88b91cb2c9e9267ed406f0f652cd82c788318ca671e7bf6fc6b4b810f780a04521bc37d

  • SSDEEP

    12288:t1TVVfbfGyO2NHb64vVEWiFjwqLlShatH1GK:9NeyO2NHb64vVEZjbLlS0D

  Score

  10^/10

  quasaroffice04discoveryexecutionspywaretrojan

  • Quasar RAT

    Quasar is an open source Remote Access Tool.

    trojanspywarequasar

  • Quasar family

    quasar

  • Quasar payload

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Drops file in Drivers directory

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  behavioral1