Extracted

• • Target

    Quote RFQ #00926720250204.pdf(39kb).com.exe

  • Size

    3.6MB

  • MD5

    07a4d2a1981e4159e744e3f0bb8d655f

  • SHA1

    fe47d1646972e85667408a28d8db2f2c17b7a313

  • SHA256

    ce54308e4ba6119f23d6e430e936d1f7dc5f8156c61003e05883c7adbf94e9d9

  • SHA512

    b03cd73c43a0e6a536857b523fa5c96910bf8a73002bb4bd7b8315f951eb9e1f625e3e3804a31cec689b6d8a427df600547cf4becf8494c3c3397a2382a55a4e

  • SSDEEP

    98304:6inq/fUlXQu4UB5uq8yPk4KVJgGSg/RSpSTddPTC:3q/fyD4UAlyfKV7Sg/QwTrP

  Score

  10^/10

  quasares codediscoveryspywaretrojan

  • Quasar RAT

    Quasar is an open source Remote Access Tool.

    trojanspywarequasar

  • Quasar family

    quasar

  • Quasar payload

  • Executes dropped EXE

  • Loads dropped DLL

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2