Extracted

• • Target

    burpsuite.exe

  • Size

    208.5MB

  • MD5

    c620d52e37416cb660c9fdbc12b79620

  • SHA1

    c85d5a9b869c2dca927a2304f42f0c59a0943f85

  • SHA256

    43d6050cb107bbb3cc4023eb2f735e54b072759f08182098ef612474f028e68a

  • SHA512

    02e1ac86231815e5f476d8ce32dcf6e6dbab5618c835f4c27ab053d05730b8f56be9216c88ab1748b1d910c3ae9f79ea626c275b2860d56a7d65712ba4970406

  • SSDEEP

    6291456:xh3YtmOWCkh3PjGl8bJcA8HKWEuxp5HT:fYtmO6tPKMJUqWEuxv

  Score

  10^/10

  quasarloomis3discoverypersistencespywaretrojan

  • Quasar RAT

    Quasar is an open source Remote Access Tool.

    trojanspywarequasar

  • Quasar family

    quasar

  • Quasar payload

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  behavioral1