Extracted

• • Target
    Xeno-v.1.3.56Legacy.exe
  • Size 3.1MB
  • SHA256 598c6ecbf403b9b18e81d75b351e5bfb34f573607a859ede02de17077a78ccc6
  • MD5 3b6099f0e202e23d11df8cea91e2d41b
  • SHA1 d0688596aa60296a83616ad130553f0c6884398c
  • SHA512 9f4fbaa00edc8ed5282215e4bf2114602dac80512400cdab39f31327754ad8afd0a2b18adf257d755390ff092a2edbb888e76ace5dcfb833b16297732a8a969e
  • SSDEEP 49152:Sv3I22SsaNYfdPBldt698dBcjHqhxNESEak/iVLoGd6uQTHHB72eh2NT:Sv422SsaNYfdPBldt6+dBcjHoxxt
  • TLSH
    T126E55B143BF85F23E1BBE27395B0041667F0EC2AB3A3EB1B1191677E1C53B5059426AB
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  adwarexenodiscoveryexecutionquasarpersistenceprivilege_escalationspywaretrojan

  • Family: Quasar RAT

    Quasar is an open source Remote Access Tool.

    trojanspywarequasar

  • Quasar payload

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Event Triggered Execution: Component Object Model Hijacking

    Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.

    persistenceprivilege_escalation

  • Executes dropped EXE

  • Loads dropped DLL

  • Modifies system executable filetype association

    persistence

  • Adds Run key to start application

    persistence

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Checks system information in the registry

    System information is often read in order to detect sandboxing environments.

  behavioral1behavioral2