Extracted

• • Target

    Client-built.bat

  • Size

    1.9MB

  • MD5

    ca98faeecf7f69f417e6b8e706986b2e

  • SHA1

    2ed0d04b476658f57e50b86dba53cdc0edb379e8

  • SHA256

    69d3f18cd40fe951e863d6f7cb34f623ae1f169a030c166efd713630744b14da

  • SHA512

    ad3a6e51492f68bf623b08d01d8d9cc9bc58a6496e04c734ddacd2be120987f56ff228bf24f92a67aff408d801a670cfbb83564907219523776b7a8263b41d64

  • SSDEEP

    24576:DqPPl9YNqSrDNfqgg4edWKa1tpD0jH3F8DbFkBNKUXuiFgZULkB4VmVc0i6MwGxb:W1cqzx/WOrBSkQJ8b

  Score

  10^/10

  quasarnewexecutionspywaretrojan

  • Quasar RAT

    Quasar is an open source Remote Access Tool.

    trojanspywarequasar

  • Quasar payload

  • Command and Scripting Interpreter: PowerShell

    Run Powershell and hide display window.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Drops file in System32 directory

  behavioral1behavioral2behavioral3