Extracted

• • Target
    update4.exe
  • Size 1.4MB
  • SHA256 59d46a3af61bae823a061cb17369826afdf7fa1b1c29fe96c85b236921c95eb6
  • MD5 2ca9e9f9fd9d94b8341099d43d4dee0e
  • SHA1 c359e76b844a558af6684f2c30af7cf4aa081d43
  • SHA512 246d42c0e30cb3c7e179ff6cdff758d16dd40b354fbe5ee5f870c5cf072405086a35dd9b1497912b4c525decd27f8f402dfdf652465f07d7dac0061720623031
  • SSDEEP 24576:1AlCWjwCsPvsSZs6tr15dgCPqtPS9U45JDzKpbfYLcf55gMFE0ZJWcfm:1uljKsasedggoPWU45JPobvf55NmcEc
  • TLSH
    T178651298335ADC03C8D66BB84871D3F01678CE89E521D313AFEA7EEBB4BA2151D46345
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defense_evasiondiscoveryexecutionquasarpersistencespywaretrojan

  • Family: Quasar RAT

    Quasar is an open source Remote Access Tool.

    trojanspywarequasar

  • Quasar payload

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Downloads MZ/PE file

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Drops startup file

  • Executes dropped EXE

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1behavioral2