Extracted

• • Target
    jaffacakes118_Trojan-Spy.MSIL.Quasar.dzd.630d84da89f688fc462d522d30f37431
  • Size 2.1MB
  • SHA256 69956d237769fe359e2b3820abfb8ecc8dd047201a9fa7d074105c2f9557c8ab
  • MD5 630d84da89f688fc462d522d30f37431
  • SHA1 5248bfc8064caa6b113a329b0cc89042f7d969cc
  • SHA512 d6954881589f52b0725023f220ebab025651091ab68c1b352944d5f37aafb4ea61ccdb20c027bf7d85e7db24922277c90ccc49be00d520e2e8715591b3cd5656
  • SSDEEP 49152:twZMDFlB3+HV5xPQMeRbyrhEAyucZ6Q3R+T8/kS:tkszEVT7mbyrhVyH3RZ/z
  • TLSH
    T19BA522373694CD72C0F26235CAE467F0A16EB6754EB3B15760486B7E883068768486BF
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  botnetdefense_evasiondiscoveryexecutionquasarpersistencespywaretrojan

  • Family: Quasar RAT

    Quasar is an open source Remote Access Tool.

    trojanspywarequasar

  • Quasar payload

  • Identifies VirtualBox via ACPI registry values (likely anti-VM)

    defense_evasion

  • Checks BIOS information in registry

    BIOS information is often read in order to detect sandboxing environments.

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Identifies Wine through registry keys

    Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

    defense_evasion

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

    discovery

  • Suspicious use of NtSetInformationThreadHideFromDebugger

    defense_evasion
  behavioral1behavioral2