Extracted

• • Target
    2026-11-09_3001125c7076ac3c11251e2866d09453_amadey_elex_glassworm_icedid_mass-logger_quasar-rat_xrat
  • Size 2.8MB
  • SHA256 7bfb504e3277c3e151df4c76286d53332e259b40597e9114af6ff6a251298096
  • MD5 3001125c7076ac3c11251e2866d09453
  • SHA1 f0f417707ea3c86795a482da676cf493a4c8758c
  • SHA512 39db3a73e5e63f208e0ebfd10b8159d3ea74c898e41b6c64d9166552178ec376251976541299b6e1e7cdd57868d5572ff82e6877db6bef895f29c477cfd32495
  • SSDEEP 49152:1e9jlRmTYjU9NtY2pWcDxgG4j/OpVwIP9TWG/OpVw1P9:1e9XjS/eGTC
  • TLSH
    T1CDD5BE2177F9422AE2FF5B3AA87145094B73FC529A36CB4F065471AE0E737808E21767
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  quasarspywaretrojan

  • Family: Quasar RAT

    Quasar is an open source Remote Access Tool.

    trojanspywarequasar

  • Quasar payload

  • Custom signature

    Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)

  • Custom signature

    Detects Windows executables referencing non-Windows User-Agents

  • Custom signature

    Detects binaries (Windows and macOS) referencing many web browsers. Observed in information stealers

  • Custom signature

    Detects binaries and memory artifacts referencing sandbox DLLs typically observed in sandbox evasion

  • Custom signature

    Detects executables manipulated with Fody

  • Custom signature

    Detects executables referencing many confidential data stores found in browsers, mail clients, crypt

  • Custom signature

    Detects executables referencing many email and collaboration clients. Observed in information steale

  • Custom signature

    Detects executables referencing many file transfer clients. Observed in information stealers

  behavioral1behavioral2