Extracted

• • Target
    documento-2026.exe
  • Size 3.4MB
  • SHA256 0c0142ab91917f30122126a202944b867a70cdffd78dfb22639ff19e92ea3d8b
  • MD5 4e06f9330f31a8d2fef3fa6ddfa67643
  • SHA1 1017c9e1684a9148beeb4d8320bbbab39419ad83
  • SHA512 8e572595866e1aadf209e6652bb526a7cbc9c8dcf0f646cade207032d9483e1e38d9558d8d69d6b94e96b7fe426207c29947e55080ef00ee3c5918bb05a23b4e
  • SSDEEP 98304:J8kGfn0kk6G0ca4Il3R4PJ+g2uW/AXI31w09VK/E6:Jk0kkdwNOPJ+tn/AYqsK/E6
  • TLSH
    T15CF533051660C91FECAE473B679BED52B672F5113463872FA5CB270FE7B2AC08909235
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  portugaldiscoveryquasarpersistenceprivilege_escalationspywaretrojan

  • Family: Quasar RAT

    Quasar is an open source Remote Access Tool.

    trojanspywarequasar

  • Quasar payload

  • Creates a file in the Startup directory

    A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.

    persistenceprivilege_escalation

  • Executes dropped EXE

  • Loads dropped DLL

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

    discovery
  behavioral1behavioral2
• • Target
    $PLUGINSDIR/InstallOptions.dll
  • Size 15KB
  • SHA256 efb07b38b205f4dcde166887df43c089cfecff627099922cc0c88fce27075063
  • MD5 6982595ed8bad3e983d6200201b9a1ab
  • SHA1 ddf3790820f6800e975e2293d46c95e1429b1d3d
  • SHA512 3bf611bf9792b275632dc6980bb8f8ff522109db7365c936b2a340d2997ace6658af6dce3c8082de4e3a5b64cd2324ac21f67de061908933666fb1aa529a6eed
  • SSDEEP 384:mLbZ+21yxu6kGxPcSkfWpATCzip8OvNV:Mbj1yomESkQNRi
  • TLSH
    T13A624C2137D51073DEA126B26AFB63179FA2B61124D24C0B8E736EC71D2D681DE34763
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  3^/10

  discovery
  behavioral3behavioral4
• • Target
    $PLUGINSDIR/LangDLL.dll
  • Size 4KB
  • SHA256 e80cfa37169aecfee7d91508d1025706294d47b2950debf2c31e6ba52f3b8cf9
  • MD5 6e8035da51e2512fb88440d8d94ac38a
  • SHA1 c7e96e638450a40cb163b66ff60300e143940921
  • SHA512 1b8c849676d64b7e380aa884f3688ed1e6544aa4cd54a998522195d877e7a4c3071ff4fcc1478cd3afd1f77e89bee12faefe85db056d496d42a047801d69bcfd
  • SSDEEP 96:34Nr2mIDHfLfzMUyJ1Cb/zdYumvhTHVYE:I12mIHYUy4/RBiK
  • TLSH
    T10791A5B6F7D049BAD1B2853A6867738726A3FEA01319800F869356D61101DCFDE3DB83
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  3^/10

  discovery
  behavioral5behavioral6
• • Target
    axHPReader.ocx
  • Size 381KB
  • SHA256 0c97849e53c43a0d61086452155512892cf8e3b307e311f9066f8fae2ca7e9e8
  • MD5 1a984a2228cec5ac1e0483ba10e21fc4
  • SHA1 574492dfd10f0583f946bb74eb1d6f205729eaa9
  • SHA512 492550b2048c620832ac19446edcc5f6dc9e02e7ff682277ec7c67f959426716ac547a1e612ca80a689933d9d8ca090402be72d699189f3f5172c7fcbd115e51
  • SSDEEP 6144:tnQtXcj8JbB73C+kxky3ujK1we/MgTjvzyZegVXtyV8K/2rA0i+H:tmbBzkxB7MgXvzyZegVXtyVZern
  • TLSH
    T16A846D11B7C0C032D2AF3534655AE6B966AEB8705FB98287EFD0177E1E305D2963C70A
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  3^/10

  discovery
  behavioral7behavioral8
• • Target
    hpreader.exe
  • Size 6.1MB
  • SHA256 08c7fb6067acc8ac207d28ab616c9ea5bc0d394956455d6a3eecb73f8010f7a2
  • MD5 4864a55cff27f686023456a22371e790
  • SHA1 6ed30c0371fe167d38411bfa6d720fcdcacc4f4c
  • SHA512 4bd3a16435cca6ce7a7aa829eb967619a8b7c02598474e634442cffc55935870d54d844a04496bf9c7e8c29c40fae59ac6eb39c8550c091d06a28211491d0bfb
  • SSDEEP 98304:VZQIM+/nv/CDoAkYwpAa5ge1zZ/jtdZwUkQ:bJCKlA2VKUz
  • TLSH
    T1DA56CE11A7419439F4E304B28A7DF2AEA968BF31071651C7A2CC3D9D9AB4AF23D31717
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  3^/10

  discovery
  behavioral10behavioral9
• • Target
    npHPReader.dll
  • Size 24KB
  • SHA256 32ebc11a10d93936fafbfc5ce255b2f5a211e806cc8b33a07d0f433c80cfca30
  • MD5 0603d14b944a927c37494fd1694f8f8d
  • SHA1 54ff7b8e15f2f1d198fc1acde811ccf5052b7388
  • SHA512 4a4d9cd55b38e8aefb046fdc121dc7ff17977a58c5f82ce7b0fc0da714afeafe43af424a9b556d4fa9707496d18fe7008975c27625a5b8e3868c381dd3ff9ae9
  • SSDEEP 384:v55+lmBmUXsT/k1j23aEyHfuCiVx/YMnACt9l4EwMQ3dLi:RkUgSszkJ2ofliVxvtX4bLi
  • TLSH
    T131B228022F960033FBA50DBA71FAE6135C7EB1522BF544CF9213928A09913D26F7473A
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  3^/10

  discovery
  behavioral11behavioral12
• • Target
    msimg32.dll
  • Size 7KB
  • SHA256 ed692098cd358bc6ca81b210dca5916ab17eb1b7abcc540d9fa725b8d1630bbf
  • MD5 d57d4e0b0a1453b1475a7fe88f9c30bb
  • SHA1 79b2183664dcd216fcee3f0ffe4d0d56f199e107
  • SHA512 daa86ec5da4042a7baf83aba6f9146a9e440dca4c030a1a409c8f1cf2144e55e0d3f7c02242c88167e8ad5f49cff20da37aa20dca808a3a702b2941f16761d3c
  • SSDEEP 192:dusiUslyDfGR5gAmPh1awz8zRZZW3JIW:dzFDeRiXPewz81ZZWZIW
  • TLSH
    T157E1D75073950912F0A74BB884BA7B1B37FD3924CF23CBD79940168E20356D4E5BCB6A
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  3^/10

  discovery
  behavioral13
• • Target
    version.dll
  • Size 79KB
  • SHA256 c15014ac221fdaccddb9f105ffdf7341fc4545eda3422f2cd4d01639d74e5942
  • MD5 36df217aaf94853cc4966bf2e09ef595
  • SHA1 8361104863728faefb01dbbdbea070397de24733
  • SHA512 ca5d3d9a02ffc91d0716de8ccbf0eeda824475a1b05a5a0ec6cd0250c54369d52b54f28b3df8ca7ccda59fbda3f8247b4d4b790ae59afb2f8306c8d7ac480a4f
  • SSDEEP 1536:eHiC6IZxRDI0TQA617/QQAZ1HhHQihMRMNsMx9Lxb0weQkLplD33N9zFmckVPxIN:eHiMy08QQAFMRBMDLmwvkLpF0ckVPxIY
  • TLSH
    T16D833B31E392D096C5B661F3375A72A2657C3B320091688FF3D5AE09BE719D9DA0C723
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  8^/10

  discovery

  • Badlisted process makes network request

    Network request originating from process or tool commonly abused by malware.

  behavioral14behavioral15