Extracted

Extracted

• • Target
    2026-07-09_2357b081660f1098ce70df3f90898c23_agent-tesla_darkgate_elex_glassworm_hawkeye_maze_quasar-rat_remcos_xloader_xrat
  • Size 2.0MB
  • SHA256 618e24bc757a8a6b5299ab84e389d264830a875c2ffb59906fd914460488cf18
  • MD5 2357b081660f1098ce70df3f90898c23
  • SHA1 af682485d39f94e803abdccc2c9da84e7e72663d
  • SHA512 8288cc1dc404069f34b4986f55a77bc280034888eb3f53a78d582a80ee468172b943878fdbfdae4b5f85b82ddf99073a8080ca62ff45824020825ea05e0da4f0
  • SSDEEP 24576:su6J33O0c+JY5UZ+XC0kGso6FaI1IXgM6YmenKKSUlmDaGJTA4Pqa6jUvOkQwKYo:2u0c++OCvkGs9Fap5aLKLkDl+dUvO9Yu
  • TLSH
    T1B2A5BE41A3DC82A1CE6A4372BA36DB219B777C692634F70E1ED83D7A3E723521518353
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  ebayprofilesdiscoveryexecutionazorultquasarinfostealerpersistencespywaretrojan

  • Family: Azorult

    An information stealer that was first discovered in 2016, targeting browsing history and passwords.

    trojaninfostealerazorult

  • Family: Quasar RAT

    Quasar is an open source Remote Access Tool.

    trojanspywarequasar

  • Quasar payload

  • Detects Windows executables referencing non-Windows User-Agents

  • Detects executables containing common artifacts observed in infostealers

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • AutoIT Executable

    AutoIT scripts compiled to PE executables.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2