Extracted

• • Target
    2026-10-11_4330a4d57eb699a4c90f32388ffd9e72_frostygoop_hive_knight_luca-stealer_salatstealer_sliver
  • Size 45.9MB
  • SHA256 c449c5a14ad1a4da78b48415b09eacad51121a5c823f3d562c4d1b51009dc819
  • MD5 4330a4d57eb699a4c90f32388ffd9e72
  • SHA1 a9c3fab797f34b22e5b660733e1211ea2a78d9ba
  • SHA512 2baa94a37a4b8a6ee96a387613a1878b795081f5880c5ea37145f9c537a9a273a43c9dc71ef5b901e6543477906e48d812e5004622d6277c049a18dcd8600087
  • SSDEEP 393216:sXR3Jh0lDInGNTjBVe6Y3ShTo0yOlKM0VxoP4MyjGVAi+DjmJ3pKPF1beOuEs7/Y:hKM
  • TLSH
    T1E5B7EF03A94648E8C985AE39C9B7131576B5B84CCB3477F72EB0E6B86F323D16978701
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  fuck2collectiondiscoveryexecutionquasarpersistenceprivilege_escalationspywarestealertrojandefense_evasion

  • Family: Quasar RAT

    Quasar is an open source Remote Access Tool.

    trojanspywarequasar

  • Quasar payload

  • Detect binaries embedding considerable number of MFA browser extension IDs.

  • Detect binaries embedding considerable number of cryptocurrency wallet browser extension IDs.

  • Detects Windows executables referencing non-Windows User-Agents

  • Detects binaries (Windows and macOS) referencing many web browsers. Observed in information stealers

  • Detects encrypted or obfuscated .NET executables

  • Detects executables containing SQL queries to confidential data stores. Observed in infostealers

  • Detects executables containing common artifacts observed in infostealers

  • Detects executables referencing many confidential data stores found in browsers, mail clients, crypt

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Creates a file in the Startup directory

    A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.

    persistenceprivilege_escalation

  • Executes dropped EXE

  • Reads WinSCP keys stored on the system

    Tries to access WinSCP stored sessions.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

    discovery
  behavioral1behavioral2