Extracted

• • Target

    Client-built.bat

  • Size

    1.9MB

  • MD5

    f8783f60ab5e5665f88d15125937097a

  • SHA1

    d401c0545a1596c34e0a0f5d7f4a8e90c0444b07

  • SHA256

    238be5cbe7d3d26bd815468a35061520c984e73ef6eeefe202ad5a173372f136

  • SHA512

    7173b42b72b2b4bfed091945c1843dfe5acdcc701db37e6432eaabd96ef74252ee21ed01ea67e56ebc12e70248b5eaf176108886a2199ad01fc4928fd51a76b3

  • SSDEEP

    24576:CkBOAnFF88UI+78BqCNpzIihx/5b7Oy/HUagEc/Hhns1UUM92VzwvVS74y0zGQoJ:CGeJlCnxlANNKzwSX4yJjh

  Score

  10^/10

  quasarnewexecutionspywaretrojanpersistence

  • Quasar RAT

    Quasar is an open source Remote Access Tool.

    trojanspywarequasar

  • Quasar payload

  • Blocklisted process makes network request

  • Command and Scripting Interpreter: PowerShell

    Run Powershell and hide display window.

    execution

  • Modifies Installed Components in the registry

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  • Drops file in System32 directory

  behavioral1behavioral2behavioral3