Extracted

• • Target
    pastlavan.exe
  • Size 1.2MB
  • SHA256 2f9d1c4c241d751019ccf4006ad034d9fc619902a28702e0075b1ec0cc38e534
  • MD5 4f63c1411de3a6157ca601485307f14d
  • SHA1 f2c470abd6cbd852191a740b018464e02bda2a7e
  • SHA512 c777f7bbdb7c33f637d44eaf59376696393c0e167f3e0e9ca519aa3d4250e75960ba6a076634a0ea005857296bd745f6fe3a6f670c4deae6350e31dbe2d43204
  • SSDEEP 24576:HF/pgxJzck+uGW/yFoBkkAQ5euewavq6kH:HF/pgTYjqqanTYFq6k
  • TLSH
    T18F459D91B3A48906E0BF1BB89471C9384BB7BD525A35D74E08D8BC6B7EB37418D017A3
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defense_evasionexecutionquasarpersistenceprivilege_escalationspywaretrojan

  • Family: Quasar RAT

    Quasar is an open source Remote Access Tool.

    trojanspywarequasar

  • Quasar payload

  • UAC bypass

    defense_evasiontrojan

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Disables RegEdit via registry modification

    defense_evasion

  • Disables Task Manager via registry modification

    defense_evasion

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Creates a file in the Startup directory

    A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.

    persistenceprivilege_escalation

  • Executes dropped EXE

  • Checks whether UAC is enabled

    defense_evasiontrojan

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  • ConfuserEx .NET packer

    Detects ConfuserEx .NET packer.

  • Drops file in System32 directory

  behavioral1