Extracted

• • Target

    s.exe

  • Size

    3.1MB

  • MD5

    c710a6667ea3c649ee266a981893440d

  • SHA1

    064314508d0579b471c568741ce170f1d6ce61d3

  • SHA256

    1ea872be9eeda2c5637a2f53b1121e88417bf0bff95fc12a2aeee9c48f0664e3

  • SHA512

    f9cc489459127a011f4e883f53d20c146d1ee2410e77b0c767162b11e42d2c3b19fb7fb40df841ce6c18bc3f3ad1b453de7692abaa69db71373c5a953fd31fe6

  • SSDEEP

    49152:bvTlL26AaNeWgPhlmVqvMQ7XSK2ixNESEXk/idLoGdSTHHB72eh2NT:bvJL26AaNeWgPhlmVqkQ7XSKfxeV

  Score

  10^/10

  quasaroffice04spywaretrojanstealer

  • Quasar RAT

    Quasar is an open source Remote Access Tool.

    trojanspywarequasar

  • Quasar family

    quasar

  • Quasar payload

  • Executes dropped EXE

  • Reads WinSCP keys stored on the system

    Tries to access WinSCP stored sessions.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  behavioral1behavioral2