Extracted

• • Target

    0502a8da4a9f46a7375766b83d181aa9f38e9969b10801f80736a3598410a281.exe

  • Size

    3.1MB

  • MD5

    766e053d13e4f6750e8f694efb00fad0

  • SHA1

    2a0e1ca7711795dfe50231d03ab7d0349014df5e

  • SHA256

    0502a8da4a9f46a7375766b83d181aa9f38e9969b10801f80736a3598410a281

  • SHA512

    3de1970fc083d404a28827f25e0ff4f096d6b75a2c2367bff0476857f5e217da3f6c40f531c2b835b31233bde53bc51086c6784985294e97ce21523bbef2bd7f

  • SSDEEP

    49152:jvyt62XlaSFNWPjljiFa2RoUYIMcOhyvJo3oGdFTHHB72eh2NT:jva62XlaSFNWPjljiFXRoUYIWhR

  Score

  10^/10

  quasargithubytspywaretrojanadwarediscoverypersistenceprivilege_escalationstealer

  • Quasar RAT

    Quasar is an open source Remote Access Tool.

    trojanspywarequasar

  • Quasar family

    quasar

  • Quasar payload

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Downloads MZ/PE file

  • Event Triggered Execution: Component Object Model Hijacking

    Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.

    persistenceprivilege_escalation

  • Executes dropped EXE

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Installs/modifies Browser Helper Object

    BHOs are DLL modules which act as plugins for Internet Explorer.

    stealeradware
  behavioral1behavioral2