Extracted

• • Target

    BILLI.exe

  • Size

    3.5MB

  • MD5

    0f8d3f0739a8356c4703d9afcf3c9e9e

  • SHA1

    a188aab63cc7f889b17be4062c8f3ad9733f877e

  • SHA256

    c27d4855b7f3649b8f12ef2b55ea2db28328c9b0a5bfe7724a6d2efb4fecfa8a

  • SHA512

    42b007929164546ebf4278a4d9d1945be70be19181c7cb1be7e1c5ec3d7f43ff942a6d59e570612543bd5a8d87e763375d61c70548c9f2fb7a87da607b0987e1

  • SSDEEP

    98304:mIELk8TSeoFjXY04O4ofnyzCiygp6R3op7ScQoijW9vICaOJF:J25CFc4jfny21+pfQoHP7

  Score

  10^/10

  quasarbillidiscoveryexecutionspywaretrojan

  • Quasar RAT

    Quasar is an open source Remote Access Tool.

    trojanspywarequasar

  • Quasar family

    quasar

  • Quasar payload

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Command and Scripting Interpreter: PowerShell

    Using powershell.exe command.

    execution

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to execute payload.

    execution

  • Drops file in System32 directory

  behavioral1behavioral2