Extracted

• • Target

    Packburpsuite23.rar

  • Size

    208.8MB

  • MD5

    5efcf7a8bd877b4000b90f2ac394e6bd

  • SHA1

    bf7e9911977accdcfcfd0c3164fadc48216073ea

  • SHA256

    205fe25ce343c37bea70905bf36be8884564133e537ca8b4c2f33b7785702f8a

  • SHA512

    f74cfdbd87d5fcfb090a9ca251562d565b8ef3419d268e08f5d72d28263a7460cbb76e822110c549dba4f83ed24c9491b8c38247bb6c6c9b732b550da4d7bb77

  • SSDEEP

    6291456:Srf5A0sti5kAmJGv2Av5Iix2xEBPecCv5c3:AG0I6kAAGvBvEE5Cv5c3

  Score

  10^/10

  quasarloomis3discoverypersistencespywaretrojan

  • Quasar RAT

    Quasar is an open source Remote Access Tool.

    trojanspywarequasar

  • Quasar family

    quasar

  • Quasar payload

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  behavioral1