Extracted

• • Target

    wawenoKey.exe

  • Size

    348KB

  • MD5

    19cde915d18709c0de2e5acd6acc41ce

  • SHA1

    5478e37f33533ccb57b73c94e613f39f95db3e06

  • SHA256

    f1bcf4d98fef3665492ca5fbf5296fa06a4adb2b3b9681b110a148f56ed1aaf6

  • SHA512

    a1bba884336a8e7a370b218ae70427d791587c25e2e9f52ee59459df1cf60bf7ef8a488e1d159c9b501329d7049349637a23d5b2e5fbe32e4a6fd1884c0b068d

  • SSDEEP

    6144:pX6bPXhLApfpuCmvXtjghbSS4JmtD15FJYa8O:JmhApePt0J4JmlbFJY3O

  Score

  10^/10

  quasaroffice04discoveryspywaretrojan

  • Quasar RAT

    Quasar is an open source Remote Access Tool.

    trojanspywarequasar

  • Quasar family

    quasar

  • Quasar payload

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  behavioral1behavioral2