Extracted

• • Target

    BT.exe

  • Size

    3.2MB

  • MD5

    a2f9781e42a8da5eb3cbe8a4dba009e6

  • SHA1

    61baaae3da49b0985fa32e6ef9c6ca7a422e0eb4

  • SHA256

    c6d8cde7cd9d0731356ae426c5b6d3d7a8ab05143fa78d257af9b9d037be7b49

  • SHA512

    fc5b0416333ba59d7af489255f258db879bf1b7639000a54ff233b100cb50ff57f0026512d58fb540d87cdac0a398c1b796ef4156cd8293e4a1978b2f4c0aa15

  • SSDEEP

    98304:1OXPiu6YrHfZ1diRq+/gr56mQr+dFiJzqGT4q:Qiu6MfZ1dt+AVq6mei4q

  Score

  10^/10

  quasarsvchost32discoveryexecutionspywaretrojan

  • Quasar RAT

    Quasar is an open source Remote Access Tool.

    trojanspywarequasar

  • Quasar family

    quasar

  • Quasar payload

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to execute payload.

    execution

  • Drops file in System32 directory

  behavioral1behavioral2