Extracted

• • Target

    1f40225b21f035d11c1d21b13e51fcc1be6be091825cf876977fe63ee51ff5e6N.exe

  • Size

    349KB

  • MD5

    dabfb0447a6890da9fe713ac91062340

  • SHA1

    fd57dd243e2a0ef131433eb433c9f007bed44a90

  • SHA256

    1f40225b21f035d11c1d21b13e51fcc1be6be091825cf876977fe63ee51ff5e6

  • SHA512

    87d156130e4aecb2fc163ebc2784674c11fc0941e794655031b0c4261d2f602665863972989ac55485c097cf475c5f4801ef618cf0fe5cab284411fd708d1066

  • SSDEEP

    6144:UsLqdufVUNDaq5/uqlCWuXecmE4b3eJRB/W:PFUNDa0uqlCWXcmEAeJRBW

  Score

  10^/10

  quasarnew worlddiscoveryevasionpersistencespywaretrojan

  • Modifies visiblity of hidden/system files in Explorer

    evasion

  • Quasar RAT

    Quasar is an open source Remote Access Tool.

    trojanspywarequasar

  • Quasar family

    quasar

  • Quasar payload

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Drops file in System32 directory

  behavioral1behavioral2