Extracted

Extracted

Extracted

• • Target
    FACTr.js
  • Size 348KB
  • SHA256 1273747abdba8032d7c6483e7a475fb2a2b4adebdf6906c87b5ad9aef9b18183
  • MD5 2e231b82fe193dc9706228b4784c981a
  • SHA1 466f9baf7a49879f3e63208bbb06a33313fe0a41
  • SHA512 b738a5fc791206c1e5f563fccfd811092e4231dea28c1a9e7dd4ee93f9956d1c1dce84e08fab9a0dcae2eb036161808ad0fe981ae20cde7064c2755c741ba189
  • SSDEEP 1536:u762h76hQ76z76676z7876Z76Y766761762h76hQ76B76676U76i76676a76076r:p8O8S8S8S8S8S8d8d8S8S8S8S8M
  • TLSH
    T137743D7305B4CED5916EC235827ED5C055BAAE026A62F30CF0CCB3B9A4DE4F9DA05C99
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  boradiscoveryexecutionquasarpersistenceprivilege_escalationspywaretrojan

  • Family: Quasar RAT

    Quasar is an open source Remote Access Tool.

    trojanspywarequasar

  • Process spawned unexpected child process

    This typically indicates the parent process was compromised via an exploit or macro.

  • Quasar payload

  • Badlisted process makes network request

    Network request originating from process or tool commonly abused by malware.

  • Command and Scripting Interpreter: PowerShell

    Run Powershell and hide display window.

    execution

  • .NET Reactor proctector

    Detects an executable protected by an unregistered version of Eziriz's .NET Reactor.

  • Creates a file in the Startup directory

    A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.

    persistenceprivilege_escalation

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

    discovery

  • Suspicious use of SetThreadContext

  behavioral1behavioral2