Extracted

Extracted

• • Target

    PatricksParabox.exe

  • Size

    3.2MB

  • MD5

    0a717705a7797e35b6f5af62ffe43abb

  • SHA1

    4c823754c6cebe13ae0aec7ba874318f20445145

  • SHA256

    c973b6a179d4477cc0d52ca84e6083a679988d991b53cb29573c75668b154f2e

  • SHA512

    75d39a3fbbf3b6289330aab45471d497dec51d076dc96bf29b0bc526154bb9502745f08aee14624bca8c7b0f2c5822e2f81a8b959cd8348457015b06a2fe9ead

  • SSDEEP

    98304:zvr62XlaSFNWPjljiFXRoUYITrUCgLEEa1:75ZY2gLEEa1

  Score

  10^/10

  latentbotquasarhugrixdiscoveryspywarestealertrojan

  • LatentBot

    Modular trojan written in Delphi which has been in-the-wild since 2013.

    trojanlatentbot

  • Latentbot family

    latentbot

  • Quasar RAT

    Quasar is an open source Remote Access Tool.

    trojanspywarequasar

  • Quasar family

    quasar

  • Quasar payload

  • Executes dropped EXE

  • Reads WinSCP keys stored on the system

    Tries to access WinSCP stored sessions.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Drops file in System32 directory

  behavioral1