Extracted

Extracted

• • Target
    26_1108_US_MIX_FULLZ_LIVE40%.txt⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀.lnk
  • Size 17KB
  • SHA256 e3abb0e070582f3d43091875eb212b6e89281e3bab45093fe5ff468aa4246a7e
  • MD5 ccd7d8672bf6b52179779586de918a90
  • SHA1 2f1b075b2d225d10f403865f935cd7658f5b4eeb
  • SHA512 ed0e03597b766ae4b28cd21256e9076656191f9f409752eae3460ed04d184ac0d4819f9c44befed77318d8d24ec0bd57ee8056d835d81da7c286a340435ca92e
  • SSDEEP 96:8k2fAssaHD+xeA8nV37peXdJK+rHO+ZHOWfdeLUHFj:8FfQsD+xeZ37peXdJK6HnHvfdeqR
  • TLSH
    T1797226512AF61604F2F3BB39AC7F959048777D599A32CE4D02AD844D0FA3B109866F33
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  credential_accessdefense_evasiondiscoveryexecutionquasarmodulepersistenceratspywarestealertrojan

  • Family: Quasar RAT

    Quasar is an open source Remote Access Tool.

    trojanspywarequasar

  • PulsaRAT library module

    Core component of the PulsaRAT remote access trojan, implementing its command protocol for hidden remote desktop, UAC bypass, persistence, and credential theft.

    ratmodule

  • Quasar payload

  • Badlisted process makes network request

    Network request originating from process or tool commonly abused by malware.

  • Command and Scripting Interpreter: PowerShell

    Run Powershell and hide display window.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Reads data files stored by FTP clients

    Tries to access configuration files associated with programs like FileZilla.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Unsecured Credentials: Credentials In Files

    Steal credentials from unsecured files.

    credential_accessstealer

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

    discovery
  behavioral1behavioral2