Extracted

• • Target

    SecuriteInfo.com.Win64.MalwareX-gen.9836.14163.exe

  • Size

    215KB

  • MD5

    64bf69a02b9ec0727d0a03076d212b66

  • SHA1

    e9f97d48a3c76355a66e408470d6744dfada8623

  • SHA256

    9189fc7f2a99cbb9c2ea6d2486b3aef126e40539d18465851a7ce9ba3b3bfd7d

  • SHA512

    0069ab640b8ec75a5589f8d1ef1b63fbbe8ce9c86a8ce6ed127101b3eaf319f5f998c0a8089af27b14276adb4fcd0048c6b947b7aa04cc06bcd2e7d72b8ffd6d

  • SSDEEP

    3072:9CFLa6pQN86HH6hr4HyYLNlb7kwwORjt4b4pMBCLzzPtks82KOSuqnPSy6z83:9CXc88ahr4HPLnkjkMQtKlPSD43

  Score

  10^/10

  quasaroffice04executionspywaretrojan

  • Quasar RAT

    Quasar is an open source Remote Access Tool.

    trojanspywarequasar

  • Quasar family

    quasar

  • Quasar payload

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Downloads MZ/PE file

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Legitimate hosting services abused for malware hosting/C2

  behavioral1behavioral2