Extracted

• • Target

    Client-built (2).bat

  • Size

    1.6MB

  • MD5

    da7beeb28254ec3bb319060398c5818a

  • SHA1

    99378e5615053698c3adcd02732389dc71d2b2eb

  • SHA256

    d515f6ca3e692713a94fe4066bbba25b4d6157af0606ca17bde5c0d4f3a6e02b

  • SHA512

    7d6322396e8ecbe5e3303dd96cc1a396037d2f7d47b50714725b1138f4fc650b0ccfa1a43dd233703a860c1109a21eba527a1714319f4a08bf1a23d4b9c4a0b2

  • SSDEEP

    24576:W0aS2MAjGvh1FiDkgGi2P6xE/NPe+JXe5PRnr1uyQAI9elDqYemJe+RTeteMuSdb:NaeAjWFb/gEYtX0FmhRpTj0

  Score

  10^/10

  executionquasarseroxenspywaretrojan

  • Quasar RAT

    Quasar is an open source Remote Access Tool.

    trojanspywarequasar

  • Quasar payload

  • Suspicious use of NtCreateUserProcessOtherParentProcess

  • Blocklisted process makes network request

  • Command and Scripting Interpreter: PowerShell

    Run Powershell and hide display window.

    execution

  • Downloads MZ/PE file

  • Drops file in Drivers directory

  • Checks BIOS information in registry

    BIOS information is often read in order to detect sandboxing environments.

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Legitimate hosting services abused for malware hosting/C2

  • Drops file in System32 directory

  • Suspicious use of SetThreadContext

  behavioral1behavioral2