Extracted

• • Target
    2026-08-30_fd72003daf7b91c09348b3326ddb77a4_cobalt-strike_frostygoop_hive_luca-stealer_salatstealer_sliver
  • Size 11.4MB
  • SHA256 cc0b00d22e9f206e4844db9ce45e346ae0501ac95d7ccab552e584a553348d7a
  • MD5 fd72003daf7b91c09348b3326ddb77a4
  • SHA1 75159d2b9484969c05068beef247287a58d40689
  • SHA512 4160f62ded91758b33b972c1304321721677b70220458e197e564870ed3b6546da8d3033f5f2737f31fd2bb6c9e058bd57ce6997f9572919f54b642c73971842
  • SSDEEP 98304:AKX3/06B0nGhGmoZ7BXgiZncGEmAxlsWmmUqF49XodErGf/WiC0nyi0oMOgEL91d:AKns6QBXgn3xuW3UXaXXp9yv9M7f9br
  • TLSH
    T159C6D0137A5902F8C5A6EB38C87A0762E2647C88CB3573E32E15AB752F713D09EB5744
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  fuck1quasarpersistenceprivilege_escalationspywaretrojan

  • Family: Quasar RAT

    Quasar is an open source Remote Access Tool.

    trojanspywarequasar

  • Quasar payload

  • Detects Windows executables referencing non-Windows User-Agents

  • Detects binaries (Windows and macOS) referencing many web browsers. Observed in information stealers

  • Detects encrypted or obfuscated .NET executables

  • Detects executables containing common artifacts observed in infostealers

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Creates a file in the Startup directory

    A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.

    persistenceprivilege_escalation

  • Executes dropped EXE

  behavioral1behavioral2