Extracted

• • Target
    p2.exe
  • Size 4.6MB
  • SHA256 1b68d68b9fd200183c69084e91fe53bd5dca5c501bce1bbf1894034bc69fafe6
  • MD5 b1ceadb93463f22943f9677aa330f15a
  • SHA1 1f37d2345e765100b8dc628bb6ce098472891fe0
  • SHA512 e3011f76e20a14bb823380df026d08f8dbc440922e05d97ad5894b11cfd69ac5325dc32c1e724e44424ff32b30d647bc75fc8c963886d0cd436a56743e18849f
  • SSDEEP 98304:/RHxlqvc70zd7sWExoYnQyRazSzsDm8ijFeR/asE8DX/Pe1qN84S:Zxlq070JoWc4+zTjKl/2084S
  • TLSH
    T1B62633815EF7410FDF2748F0402BF19CF12D9B8166BE896A2A7D59265C2FAEDE953300
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  lb060424ugftyhg02defense_evasiondiscoveryexecutionquasarpersistencespywarethemidatrojan

  • Family: Quasar RAT

    Quasar is an open source Remote Access Tool.

    trojanspywarequasar

  • Quasar payload

  • Identifies VirtualBox via ACPI registry values (likely anti-VM)

    defense_evasion

  • Checks BIOS information in registry

    BIOS information is often read in order to detect sandboxing environments.

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Themida packer

    Detects Themida, an advanced Windows software protection system.

    themida

  • Checks whether UAC is enabled

    defense_evasiontrojan

  • Command and Scripting Interpreter: PowerShell

    Using powershell.exe command.

    execution

  • Command and Scripting Interpreter: PowerShell

    Using powershell.exe command.

    execution

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

    discovery

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  behavioral1behavioral2