Extracted

• • Target
    2026-07-14_6da74890831bae34b2eaef601a469655_elex
  • Size 2.0MB
  • SHA256 3b914d2c1e3dde874418603d0a8b80c755f662670adba7c99ca9377df2729c4a
  • MD5 6da74890831bae34b2eaef601a469655
  • SHA1 0f5918b8ffad3db926b50167c318e932a534c248
  • SHA512 4fff60015dba6bf19f697397e7969baac1d029bc946132b5bcd615a99017aca25899dbbd54189a7e3e73f6587c15240428792149e957c260ce02c10d3168fb8e
  • SSDEEP 24576:5aOAVUGELbyO2TPOe0gEFkqbHWfuQ5V3h3Cb:vC0aj0gEFkM
  • TLSH
    T160A5F9036A8B4E75CDD27BF461CB533A9734EE30CA2A9B7FF609C53199532C4681A742
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  office04discoveryexecutionquasarpersistencespywaretrojan

  • Family: Quasar RAT

    Quasar is an open source Remote Access Tool.

    trojanspywarequasar

  • Quasar payload

  • Detects Windows executables referencing non-Windows User-Agents

  • Detects binaries (Windows and macOS) referencing many web browsers. Observed in information stealers

  • Detects executables containing common artifacts observed in infostealers

  • Badlisted process makes network request

    Network request originating from process or tool commonly abused by malware.

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Downloads MZ/PE file

  • Executes dropped EXE

  • Contacts third-party web service commonly abused for C2

    Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

  • Drops file in System32 directory

  behavioral1behavioral2