Extracted

• • Target

    SolaraExecutor.exe

  • Size

    18.7MB

  • MD5

    20f922eb17efc661c32b9af7123cc2e3

  • SHA1

    cc225ff5794975e66fcbd7f6a6a0cf3c780fd488

  • SHA256

    8d7559b7b2641f0eddca0905f3ebd59dbe93ebf5d44603227480fbcbe69ed82c

  • SHA512

    6c332727ff87f432bd7b8f862e6155ff748d687a2da55726c1055f4b655d6ec43a4d3475a7f8be39302efe5905b5a8164bd8113598c1a0af5b85aa47071153fd

  • SSDEEP

    192:8yihNYoCYedOzbD/kyL7F9DKCvzlKHmCYOF6Qb/:8hmoCJdOzbrkyF1RKGCLAk

  Score

  10^/10

  discoveryexecutionquasarsvhost32spywaretrojan

  • Quasar RAT

    Quasar is an open source Remote Access Tool.

    trojanspywarequasar

  • Quasar family

    quasar

  • Quasar payload

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Downloads MZ/PE file

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Legitimate hosting services abused for malware hosting/C2

  behavioral1behavioral2