Extracted

Extracted

• • Target
    e-dekontpdf.js
  • Size 68KB
  • SHA256 509c2a5b7f12d2a67bfb9b697581fc9718c6ceba0575cc9e8490284fe4bdd6ce
  • MD5 f8de917e3675dd44f4efbc6ed02e984a
  • SHA1 7fcc39fefb05e24fb241c2a37ae6f08fde069656
  • SHA512 941e7c47757ed942c9d46eb01ceb3ae784bedc83c94dcb9c097591be4bf1444c64a29a7ea579be01aafae04bef229a983efcfda2c5d50dbcaf6449f4832c5c4f
  • SSDEEP 1536:IiJUwTWvh1ThiK4iqJ19mKwyQzfTu17RXuH+:IiJUwTWvh1ThiK4iqkfby7Me
  • TLSH
    T12863FF6123C1F812218F2FA3FB1BF5F5E72A7D9530442C4BE1687DDC566A90ACAA4C71
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  microdiscoveryexecutionquasarspywaretrojannewbypassed

  • Family: Quasar RAT

    Quasar is an open source Remote Access Tool.

    trojanspywarequasar

  • Process spawned unexpected child process

    This typically indicates the parent process was compromised via an exploit or macro.

  • Quasar payload

  • Badlisted process makes network request

    Network request originating from process or tool commonly abused by malware.

  • Command and Scripting Interpreter: PowerShell

    Run Powershell and hide display window.

    execution

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2