Extracted

Extracted

• • Target

    7f53287d24ef99c2ba182cc0e201b29c265ea2787edc11893871592fa5b8b0fb

  • Size

    6.8MB

  • MD5

    34fd87508dfbb986bbf5768197bff8aa

  • SHA1

    ddfb44995013672c9a407064e8c79ca489c788a8

  • SHA256

    7f53287d24ef99c2ba182cc0e201b29c265ea2787edc11893871592fa5b8b0fb

  • SHA512

    0eaed6df3ac42686fe74a7bc11ff98c28d594eb2465a0a2ba9902c7c59d10e8758437cc9d050d198db6c9187b8070e392eed28a8c8743e1dcf5bee75484bfed9

  • SSDEEP

    24576:cWLXvqgqyfUrp7eD5Ry9cFkAKqzBfkm5zv0fW8yFAKOt3XvMIZiHI:BLtJiF4RyaXKqzBfkm5wQWKE1

  Score

  10^/10

  latentbotquasarcriokdiscoveryspywaretrojan

  • LatentBot

    Modular trojan written in Delphi which has been in-the-wild since 2013.

    trojanlatentbot

  • Latentbot family

    latentbot

  • Quasar RAT

    Quasar is an open source Remote Access Tool.

    trojanspywarequasar

  • Quasar family

    quasar

  • Quasar payload

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  behavioral1