Extracted

• • Target

    fugelatogoan.bat

  • Size

    516KB

  • MD5

    441fb12fd410cc730b25b879fcfe2d29

  • SHA1

    b958859d1f90eec6a36eab2ffcf4de70db335eeb

  • SHA256

    0d7b96872fddd86198ffb9096c4c03d0a5bb3c0fb80e214e855c22e04fc23208

  • SHA512

    5d401519488cddf4c8c37494beb66b3bb56a3715554385ab210fb600986152071759473f6f5e755fa9014c26cc7a3ce4abd7d90b5bea894b36288dc8331153f6

  • SSDEEP

    12288:GAhqQ5buCyD3bfLOhflJ1iNSN8cm/yL/iWPuGApijcnuv:GWquobMvkNG0/y+WVAp8v

  Score

  10^/10

  quasaroffice04executionspywaretrojan

  • Quasar RAT

    Quasar is an open source Remote Access Tool.

    trojanspywarequasar

  • Quasar payload

  • Blocklisted process makes network request

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Drops file in Drivers directory

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  behavioral1