Extracted

• • Target

    win64_svchost.exe

  • Size

    3.2MB

  • MD5

    f31a91bff6bb5805f4f7b95c0a27cb2a

  • SHA1

    8eeef2262c4288c035d7be99f27ce478dae008ce

  • SHA256

    f9fc23fe47d3c918c7bc24cbe14e56d9b0024e31660f2a280f3991291b3e5882

  • SHA512

    07f750faf48ef505de12a07acf64136468702ba07d7b5ec9ecbc3d2f6e5c04c3c7ce0ff4b178c5f2f3a1df2b9b0ea8f54687f90137fa58603ddd0896733eaacb

  • SSDEEP

    98304:p1AhvWM65Mf9cZR4FklYJr41ADevpgaSoJxqGT4q:WvWM6iGKkCJ0GevCaXsi4q

  Score

  10^/10

  quasarsvhost32discoveryexecutionspywaretrojan

  • Quasar RAT

    Quasar is an open source Remote Access Tool.

    trojanspywarequasar

  • Quasar family

    quasar

  • Quasar payload

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to execute payload.

    execution

  • Drops file in System32 directory

  behavioral1behavioral2