Extracted

• • Target

    0x000600000001946e-14.dat

  • Size

    556KB

  • MD5

    85410a49050c880d856c15b4c958d86d

  • SHA1

    f520f25b5cd537b1060d8ca66f53bac745f8f8fa

  • SHA256

    9365b6cee47eecc6eab2c6d138f0d5714c31ff1473143ce14ce874eb896f01b3

  • SHA512

    94ac76b3fb61b14f39b9cc9848d530842c834ae32efede2da7c5ce3d062940a788391d7b22e888ec5b024dba7437ef043ee11554fe62509e1f71ee202791f7d5

  • SSDEEP

    12288:QusTy3x2mUEiLYStKT7yFPb2bNRZGU6rCUk:Qq3nUIStKHIPbcNREo

  Score

  10^/10

  quasaroffice04spywaretrojandiscoveryexecutionstealer

  • Quasar RAT

    Quasar is an open source Remote Access Tool.

    trojanspywarequasar

  • Quasar family

    quasar

  • Quasar payload

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Drops file in System32 directory

  behavioral1behavioral2