Extracted

• • Target
    2026-05-09_6762d12ea2d45bf17bd1e87e251467c0_cobalt-strike_glassworm_hijackloader_icedid_luca-stealer_njrat_stealc_vidar
  • Size 3.7MB
  • SHA256 a0c9f01334ae7b1330369bdd3c32917a5e539c1c0a547d86dc6eb37a62b6f862
  • MD5 6762d12ea2d45bf17bd1e87e251467c0
  • SHA1 af0c5706d7333417cf1764a22e9f8719bbd95169
  • SHA512 bb6d26fa72613f9d2298ee25253b4228f46a12cf3f31a3ef0cf8577f633ec7a6c07def3cd0b28758493c78bc328149878141aa41bdbe63e8069095009c064eab
  • SSDEEP 98304:fYl4byYl48dJodbibejx0aV20D636d144K8:fw4Ww488dbibejx0aVfD63glK8
  • TLSH
    T14D06AE6BB6A442F8D0A7C27888A38653E7B1B815077157CF02D5876A2F33EE01E7E355
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  quasarpersistenceransomwarespywaretrojandiscovery

  • Family: Quasar RAT

    Quasar is an open source Remote Access Tool.

    trojanspywarequasar

  • Quasar payload

  • Custom signature

    Detects Windows executables referencing non-Windows User-Agents

  • Custom signature

    Detects executables containing common artifacts observed in infostealers

  • Custom signature

    Detects executables packed with Enigma

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Executes dropped EXE

  • Loads dropped DLL

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  behavioral1behavioral2