Extracted

• • Target

    MultiTool.exe

  • Size

    349KB

  • MD5

    d0102723a4f0bd219d334c33e6f2bd7d

  • SHA1

    d5b64ca96a7bb98be2f2d5c30b0fa6c2a0f02c80

  • SHA256

    9f4e2c1064a40a336930a7dca6c9c153c5f0c587f4e18055eabdb5537350afdf

  • SHA512

    27d776337fa6e2f800bf8de95a54419cbbbb9f8b2bc0fd0754150715bca47048dae9a8b7a2e830d89ff5d9b89e19b1ccfaacbaac850bf9d1a7f6896480cc1ef8

  • SSDEEP

    6144:KK2J10qdSlEc39HGPj4cgdgcKKwVbrukSrzMinzG0Q:KKFE4cWFKKwBukQz00Q

  Score

  10^/10

  quasaroffice04discoveryspywaretrojan

  • Quasar RAT

    Quasar is an open source Remote Access Tool.

    trojanspywarequasar

  • Quasar family

    quasar

  • Quasar payload

  • Executes dropped EXE

  • Loads dropped DLL

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  behavioral1behavioral2