Extracted

• • Target
    2026-08-04_06f99b6c8598d3b3ca9b31a2fb927101_cobalt-strike_glassworm_hijackloader_icedid_luca-stealer_njrat_stealc_vidar
  • Size 2.9MB
  • SHA256 e31b7932b2305fadc00ddb8785ba11519fd1790c9918e60da455ff1bfa52480a
  • MD5 06f99b6c8598d3b3ca9b31a2fb927101
  • SHA1 34a1040198fe3fd600e72f557845683ff2a29d1e
  • SHA512 12972823de3694b066aaf8cd8c64de43f862a1bd0b13fcfd7c6f4ab4c2ccb6dabdd051d1101be5e5694d26612c5bd2f381f79948a8785a8327df85bb15244eae
  • SSDEEP 49152:4RGl4ysTQeSU5wb71CaWFAAj75SKxtLQ02dbibejx0aV20D6/JTpP8Uod1vDCLyN:4Yl4KeSUab7KuAj75Jodbibejx0aV20x
  • TLSH
    T1CBE5AE6BB66446E8D097C27848A38653EB71BC54077153CF02D5876A2F33EE02E7E35A
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  adwarediscoveryexecutionquasarpersistencespywaretrojan

  • Family: Quasar RAT

    Quasar is an open source Remote Access Tool.

    trojanspywarequasar

  • Quasar payload

  • Detects Windows executables referencing non-Windows User-Agents

  • Detects executables containing common artifacts observed in infostealers

  • Detects executables packed with Enigma

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Loads dropped DLL

  • Drops desktop.ini file(s)

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

    discovery
  behavioral1behavioral2