Extracted

• • Target

    Nueva Orden de Compra.exe

  • Size

    899KB

  • MD5

    da4bdaef912fbec33c8f6c787c951420

  • SHA1

    db3d1d6ee8647c350d19bbc0bb0509811373d436

  • SHA256

    5017f298316f0ee887a1251d0cff9549d98feb8fbca8a4cdf83ef2ade555adb2

  • SHA512

    9673db99e7e194d7e9c402f6066f14245f9cc5e1ab133ad7b45a76f4c2c7d1b3d9d3c14974fe469bda6e959223205ebd2b047e486b17bd2ed8f3d8c6221540a6

  • SSDEEP

    24576:AvjQG02u/rcfrYbJ1G3FroaICdyk6ljh:eQwercsbXONoaPds

  Score

  10^/10

  quasarstroy3discoveryspywaretrojan

  • Quasar RAT

    Quasar is an open source Remote Access Tool.

    trojanspywarequasar

  • Quasar family

    quasar

  • Quasar payload

  • Downloads MZ/PE file

  • Executes dropped EXE

  • Loads dropped DLL

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2