Extracted

• • Target
    PrismaClient.exe
  • Size 5.3MB
  • SHA256 e35919f0d1eaf55b42c9a6278eb1be58502b8f88907e6c78b068eb32d9ebd715
  • MD5 ebc45ea921700e63811baf5327a255f4
  • SHA1 953b364dc253b6286275956b49fc8949fa944ad6
  • SHA512 de106df51a131769839709de734a591e1fd3cf94a5a1054788f4e5da85b18bdb557d5864599e52c5e97ccff3dbd1c7eaf87c7c0b66cca6f36cd1b2d479cb46bc
  • SSDEEP 49152:CwbSwHjCyoomPVAtHbi8wjyi8zbi5/V1OhJ4+JzUPD2itixo0OALWbbJT+lruWqt:CbwHW7At7i8OIhJWiiDJJSl
  • TLSH
    T12E46AE04BBF84E67D16FC275C4B14052ABF0F89DA323DBDB2681967A2D23B808D51767
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  office04collectiondiscoveryexecutionquasarpersistenceprivilege_escalationspywarestealertrojan

  • Family: Quasar RAT

    Quasar is an open source Remote Access Tool.

    trojanspywarequasar

  • Quasar payload

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Executes dropped EXE

  • Loads dropped DLL

  • Reads WinSCP keys stored on the system

    Tries to access WinSCP stored sessions.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

    discovery
  behavioral1behavioral2