Extracted

• • Target
    2026-11-09_14b4bd20f3b5b4c992d54927c30d9121_amadey_elex_glassworm_icedid_mass-logger_quasar-rat_xrat
  • Size 2.4MB
  • SHA256 f6c0c191024caa5c6f55fb0cb76f3aba9144c315620c5dbefc5fc8d222580b3f
  • MD5 14b4bd20f3b5b4c992d54927c30d9121
  • SHA1 620a8dd4a5e6f55fff237aead9571cb08c786312
  • SHA512 1536c85b4e82e0b3941157c907bb400daaebc10253a6ebded7b03a4cf988eb22d943dbe0066a27ff419a06ba96b60fb836ae4d7dbafb896862be544d44e2b59c
  • SSDEEP 49152:Fe9jlRmTYjU9NtY2pWcDxgG4j/OpVwIP9B:Fe9XjS/eGT
  • TLSH
    T117C5D02137F58226E2FF5B39987245098776FC528A36DF8F069471AE1E737808E21763
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  quasarspywaretrojan

  • Family: Quasar RAT

    Quasar is an open source Remote Access Tool.

    trojanspywarequasar

  • Quasar payload

  • Custom signature

    Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)

  • Custom signature

    Detects Windows executables referencing non-Windows User-Agents

  • Custom signature

    Detects binaries (Windows and macOS) referencing many web browsers. Observed in information stealers

  • Custom signature

    Detects binaries and memory artifacts referencing sandbox DLLs typically observed in sandbox evasion

  • Custom signature

    Detects executables manipulated with Fody

  • Custom signature

    Detects executables referencing many confidential data stores found in browsers, mail clients, crypt

  • Custom signature

    Detects executables referencing many email and collaboration clients. Observed in information steale

  • Custom signature

    Detects executables referencing many file transfer clients. Observed in information stealers

  behavioral1behavioral2