Extracted

Extracted

• • Target
    nat.7z
  • Size 32.8MB
  • SHA256 541c83e18b56be332a94fe84563f57849e41e38c3f7a9d02294bece35f0b92aa
  • MD5 e3d694a15ebb781f1357772381388370
  • SHA1 2c9077b3126686c271ff6a490d574d8c74e5e58d
  • SHA512 1b6afbd94cc800d3fe71d677f2dfe10ede4868cb0de6360f4acdd254da8421ed9e7cb04347afa53cfaa50b7022c7680e57da3388ec2b7b4f6d5dfef7132c6f6a
  • SSDEEP 786432:oZG1s9GVScQVC3E44nKMyqV1EHuTO/5WK/xnqGI5Nn5IbpT2s:oZEUGVIVJ4k3RCbZqGI5t5c2s
  • TLSH
    T19A7733E0FE223352440C81B490FE8CA8354E5D68D1D6441A53D19BFBE26589BEFBBBD1
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  office04collectiondefense_evasiondiscoveryevasionexecutionquasarpersistenceprivilege_escalationransomwarespywarestealertrojan

  • Family: Quasar RAT

    Quasar is an open source Remote Access Tool.

    trojanspywarequasar

  • Quasar payload

  • Windows security bypass

    defense_evasiontrojan

  • Modifies boot configuration data using bcdedit

    ransomwareevasion

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Creates new service(s)

    persistenceexecution

  • Executes dropped EXE

  • Reads WinSCP keys stored on the system

    Tries to access WinSCP stored sessions.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Windows security modification

    defense_evasiontrojan

  • Accesses Microsoft Outlook profiles

    collection

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

    discovery
  behavioral1