Extracted

• • Target
    2026-05-28_40852c298ccaa1cdcbc2b48c0f4e3e55_elex_glassworm_icedid_mass-logger_quasar-rat_xrat
  • Size 1.3MB
  • SHA256 a5bb9c91c3a99564b48eb8d9a9ff1ec5de3084c15224d49bf71c0a7a0eddcd18
  • MD5 40852c298ccaa1cdcbc2b48c0f4e3e55
  • SHA1 1b61a4874fc933ba3d786a1f9d06a0ed3ada3a6d
  • SHA512 34af852531f8e78ef2ad9a552ff4db18929d9c7c281b00470f30deed851a0ecd117aaf679ab4bf2a13aac1cda442b9fb6ad97cf0e689b29aa35b9554b8a17ee1
  • SSDEEP 24576:KfedLZCfxbIRxJzck+uGW/yFoBkkAxg2jJv4VDZzAT:KfeLZVRTYjqqanRaJvaD
  • TLSH
    T10555BF5273F84216E1FF5B76A8B2481487B3F4669A36DB4F098461ED1EB3780DE10B63
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  quasarxorium_stealerspywarestealertrojan

  • Detects XoriumStealer payload

  • Family: Quasar RAT

    Quasar is an open source Remote Access Tool.

    trojanspywarequasar

  • Family: XoriumStealer

    XoriumStealer is an information stealer written in C#.

    stealerxorium_stealer

  • Quasar payload

  • Detect binaries embedding considerable number of cryptocurrency wallet browser extension IDs.

  • Detects Windows executables referencing non-Windows User-Agents

  • Detects binaries (Windows and macOS) referencing many web browsers. Observed in information stealers

  • Detects binaries and memory artifacts referencing sandbox DLLs typically observed in sandbox evasion

  • Detects executables manipulated with Fody

  • Detects executables referencing many confidential data stores found in browsers, mail clients, crypt

  • Detects executables referencing many email and collaboration clients. Observed in information steale

  • Detects executables referencing many file transfer clients. Observed in information stealers

  behavioral1behavioral2