Extracted

• • Target

    Uni.bat

  • Size

    12.5MB

  • MD5

    dc6a0e74f0f377f122502fe56f24701e

  • SHA1

    a5a97d00f47d5f577bef14cee5e510c39f51bdbc

  • SHA256

    73073ff98d229b84b7d857d2934440f0107d960ece080ba1281a0940c740ccb6

  • SHA512

    94816734e3bfa98bc57132cbbabc129267498c45f23c0b1846c291248b647ab772e4e59f860ff4abd6cc37fbf8e634202268662c934f7620a1d5530134f4f1f2

  • SSDEEP

    49152:XfB9XOZ4339wz3TuoLYYx+QC7BUssJanETvN7zHOBVk3WAYaeCQyetfUBgvfHMhr:O

  Score

  10^/10

  asyncratquasarv2.2.3 | seroxenratspywaretrojan

  • AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Quasar RAT

    Quasar is an open source Remote Access Tool.

    trojanspywarequasar

  • Quasar payload

  • Suspicious use of NtCreateUserProcessOtherParentProcess

  • Async RAT payload

    rat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Suspicious use of SetThreadContext

  behavioral1behavioral2