Extracted

• • Target

    RobloxPingOptimizer-Main-x64.NEW/RobloxPingOptimizer-Main-x64/Main/RobloxPingOptimizer.bat

  • Size

    15.6MB

  • MD5

    0e7fa38a2267f6c3c8b0afafda56ef99

  • SHA1

    e116a71ae311011f1fc2697e84575990b75d96b4

  • SHA256

    30800e9982e73ce9a2f315b05630225f57b6ae1d219902b8dcde6031d840a553

  • SHA512

    75f5108166ac7224f5797941f57ada798a1bb760850677618770fb4aa7c9dd3d9298013afde66a0eba303852c9dfb2277b8bda61243c161b35975f1030ed9e98

  • SSDEEP

    49152:Cdxc9riM4QO4C2ltO7iHK35ROUcdDvgVNfLH9QDn7OusKIV+cDBGVKKjU5ECeNNI:k

  Score

  10^/10

  executionquasarspywaretrojan

  • Quasar RAT

    Quasar is an open source Remote Access Tool.

    trojanspywarequasar

  • Quasar payload

  • Command and Scripting Interpreter: PowerShell

    Run Powershell and hide display window.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself

  • Executes dropped EXE

  • Drops file in System32 directory

  behavioral1behavioral2