Extracted

• • Target

    11c1119ca27a3d70ef72d69c3f1af1ae9540d4b5d2b48d9b3caa554ba6f54cd2

  • Size

    4.6MB

  • MD5

    3ed992586de3ed67aad864fe62734937

  • SHA1

    bcf4c8a3cbc671ba7fc6ac38b1581806913883dd

  • SHA256

    11c1119ca27a3d70ef72d69c3f1af1ae9540d4b5d2b48d9b3caa554ba6f54cd2

  • SHA512

    42668112eacf827325c88af0c6ec59c16b918f6f9772ef84e15a5ad8f0b5b6dd9643fe6d2467216c1374725b9c6cb742017ec7cebb6fb2763189d1d697f6ac37

  • SSDEEP

    98304:/gYSDiz3Clzp6QcwQhgBe8MFLgg5A4gmRGo1q0ZT:oHDcSNcwQhgBimwtH

  Score

  10^/10

  quasaroffice05defense_evasiondiscoveryspywarethemidatrojan

  • Quasar RAT

    Quasar is an open source Remote Access Tool.

    trojanspywarequasar

  • Quasar family

    quasar

  • Quasar payload

  • Identifies VirtualBox via ACPI registry values (likely anti-VM)

    defense_evasion

  • Checks BIOS information in registry

    BIOS information is often read in order to detect sandboxing environments.

  • Themida packer

    Detects Themida, an advanced Windows software protection system.

    themida

  • Checks whether UAC is enabled

    defense_evasiontrojan

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  behavioral1behavioral2