Extracted

• • Target
    2026-07-15_71c391db73c420a7235e077cd5691b9c_elex
  • Size 2.0MB
  • SHA256 9ee00b456c6c084c4330ec8c494b6d795c72113309b1ba7abfd533816211b904
  • MD5 71c391db73c420a7235e077cd5691b9c
  • SHA1 f21c976824811f9d527a36992dd886446d13d645
  • SHA512 be1ebd0ba756e6ee82df02b9780d97803a0bf95e62c22d6792e71f14979b174af8cdd7f23d4a4accc705d45a1d28d1794b895862429217e9e14092073b2c3959
  • SSDEEP 24576:lIKdj6Hvw9WGIG/TPUvUzTKSL/kGuQ5V3h3Cb:1xWkqvUPW
  • TLSH
    T180A5F9136A8B0E75CDD27BF461CB633A9734ED30CA2A9B7FF609C53199532C4681A742
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  office04discoveryexecutionquasarpersistencespywaretrojan

  • Family: Quasar RAT

    Quasar is an open source Remote Access Tool.

    trojanspywarequasar

  • Quasar payload

  • Detects Windows executables referencing non-Windows User-Agents

  • Detects binaries (Windows and macOS) referencing many web browsers. Observed in information stealers

  • Detects executables containing common artifacts observed in infostealers

  • Badlisted process makes network request

    Network request originating from process or tool commonly abused by malware.

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Downloads MZ/PE file

  • Executes dropped EXE

  • Contacts third-party web service commonly abused for C2

    Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

  behavioral1behavioral2