Extracted

• • Target
    13d1b5bcc807f84aa8ebd6f69a1013ac.exe
  • Size 11.6MB
  • SHA256 acb54edce764ff6ee46bf23fcd7b0eb7347373bb9f9009f32e9da1cddb6b4621
  • MD5 13d1b5bcc807f84aa8ebd6f69a1013ac
  • SHA1 63aa9a7a28ec66eb482778c82f5c76437eb3931d
  • SHA512 3518c062abca5cb7b53f116c08014dbc298670f0c07aa768d58d544ad508cc379176008a42c755edb952571816771e7deda7fd84798dcb5c995651beae8123fc
  • SSDEEP 196608:v7uoCQEs9MQDNyUSv96nWFwK+9l46oWF5086VY:qLQxJjka19L88A
  • TLSH
    T1C2C6E0837D8692B4D6AAC332D4621194B6207C8C6B7033DB2D45FAB52D237D82FB9F54
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  fuck2collectiondiscoveryexecutionquasarpersistenceprivilege_escalationspywarestealertrojan

  • Family: Quasar RAT

    Quasar is an open source Remote Access Tool.

    trojanspywarequasar

  • Quasar payload

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Creates a file in the Startup directory

    A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.

    persistenceprivilege_escalation

  • Executes dropped EXE

  • Reads WinSCP keys stored on the system

    Tries to access WinSCP stored sessions.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

    discovery
  behavioral1behavioral2