Extracted

• • Target

    Client-built.bat

  • Size

    1.9MB

  • MD5

    44523454be47061f187cfdc2ec60834a

  • SHA1

    86136762b9296ef6517bc01b7764e59398bab09b

  • SHA256

    5a88206b2a68e2c0175d091b3a0c7b133a1b35740b4acc33f5aaebe23fc97e46

  • SHA512

    4c5f35a45ff1cfc394e19bbf1e4080fd43ea2ef9880b16b6fc316c85dc7fbdb222d03821224b3eac90a971c8f69a05ac96d86f7367cad658cfb229bf5f966080

  • SSDEEP

    24576:kxASqRPmTwkE+UrVuwEQ6/RZhDGYAiM37i9yfela6S2ZZoB+a7ZpFifK7+tLe61s:k+TEwl7Q865Zuimi7/E4mp7kScR0

  Score

  10^/10

  quasarnewexecutionspywaretrojan

  • Quasar RAT

    Quasar is an open source Remote Access Tool.

    trojanspywarequasar

  • Quasar payload

  • Command and Scripting Interpreter: PowerShell

    Run Powershell and hide display window.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Drops file in System32 directory

  behavioral1behavioral2behavioral3