Extracted

• • Target

    Uni.bat

  • Size

    409KB

  • MD5

    e68bad461697f7b7cf70903472c46045

  • SHA1

    4e0157695c828732231b628de325addfa2494ad6

  • SHA256

    670312cec4a49d69d5f23f1ef68dbe6a6f3bebb20efe6d13425016025b2f0b34

  • SHA512

    c95f3c1913540877a46b2a823e73ea053f8277f4a8b4012da17625fbe04fac6b97e2163b690ddb67430aefdd557f833bb6a66fcb09fbc6464cb50182de1a5b36

  • SSDEEP

    12288:JpiREGJq35hmgR3MarfjRYqdOIb2+USXipX:nwpJvnWj9dOm2jJ

  Score

  10^/10

  quasaroffice04spywaretrojan

  • Quasar RAT

    Quasar is an open source Remote Access Tool.

    trojanspywarequasar

  • Quasar payload

  • Suspicious use of NtCreateUserProcessOtherParentProcess

  • Downloads MZ/PE file

  • Checks BIOS information in registry

    BIOS information is often read in order to detect sandboxing environments.

  • Executes dropped EXE

  • Legitimate hosting services abused for malware hosting/C2

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Drops file in System32 directory

  • Suspicious use of SetThreadContext

  behavioral1