Extracted

• • Target

    COMPROBANTE de PAGO.exe

  • Size

    854KB

  • MD5

    e56d988fd3f4b747bf69c724085878d6

  • SHA1

    876cbcce543f49cf190a12c4a07c3139247e05ab

  • SHA256

    e490dc9257f951ed3e61055852315cac3f13dd404f88d546a06010639fb55f93

  • SHA512

    06f1c1e8c48340dda4115d0b5221502ad90a5e92e1eafc351d765ec91343a91e5bda8fb85d8cee1601a69800dd5502492310aa01b32aba5a3b11ba9120f881d6

  • SSDEEP

    24576:JRuPGExISnGAvq4TYlCjXZfQVbhImUTdlmajaO:z96wgYUjX9uhnU5o

  Score

  10^/10

  quasarstroy3discoveryspywaretrojanadwarepersistenceprivilege_escalationstealer

  • Quasar RAT

    Quasar is an open source Remote Access Tool.

    trojanspywarequasar

  • Quasar family

    quasar

  • Quasar payload

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Downloads MZ/PE file

  • Event Triggered Execution: Component Object Model Hijacking

    Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.

    persistenceprivilege_escalation

  • Executes dropped EXE

  • Loads dropped DLL

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Installs/modifies Browser Helper Object

    BHOs are DLL modules which act as plugins for Internet Explorer.

    stealeradware

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Drops file in System32 directory

  • Suspicious use of SetThreadContext

  behavioral1behavioral2