Extracted

• • Target

    MSFS 2024 UPDATER.exe

  • Size

    3.1MB

  • MD5

    5061f9f48893af28f93d03dcfb71da43

  • SHA1

    df81a197c29598332480a0e3fb32b69d31ee985e

  • SHA256

    24361c88cec81a0e499d9c5b3acb69e6d9287515a12633b0a0034d2b67bf2d07

  • SHA512

    3734e4acf53f921578eeb27cb0c2b2fb689812116e5e187e8afb1f83563da5e11ebbfce025f43ec7b6abac46fa8d6eabaf0cbcbb29701672e331576876ef5ab4

  • SSDEEP

    49152:rvXlL26AaNeWgPhlmVqvMQ7XSK9xOEMkIk/JxroGdPxTHHB72eh2NT:rvVL26AaNeWgPhlmVqkQ7XSK9xn5

  Score

  10^/10

  quasaroffice04adwarediscoverypersistenceprivilege_escalationspywarestealertrojan

  • Quasar RAT

    Quasar is an open source Remote Access Tool.

    trojanspywarequasar

  • Quasar family

    quasar

  • Quasar payload

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Downloads MZ/PE file

  • Event Triggered Execution: Component Object Model Hijacking

    Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.

    persistenceprivilege_escalation

  • Executes dropped EXE

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Installs/modifies Browser Helper Object

    BHOs are DLL modules which act as plugins for Internet Explorer.

    stealeradware

  • Drops file in System32 directory

  behavioral1