Extracted

• • Target

    Uni.bat

  • Size

    12.6MB

  • MD5

    898f49c739026123b6a3811fa31abe70

  • SHA1

    31ff6036b40d70d21cb1c4c0163cba0d4c720551

  • SHA256

    78b0a14a882dec287c0dc5a294ad02a4a5aaa0d130839d49f282c7d61069471f

  • SHA512

    a9aa2bf15db84361f315156ee6386cac49c14c2449a72e2f50b2e0b8d100781019c246c03a38a37d5dfc71a7c1c5451457faba074d1a875cab615ecb8d3e453d

  • SSDEEP

    49152:sW7ldCjqzV0qZpSjVbHDGYxqXTQPJee/X5nerh1gnfFijx6ygGSPlPNEIKlfuK1u:i

  Score

  10^/10

  quasarv2.2.5 | seroxenspywaretrojan

  • Quasar RAT

    Quasar is an open source Remote Access Tool.

    trojanspywarequasar

  • Quasar payload

  • Suspicious use of NtCreateProcessExOtherParentProcess

  • Suspicious use of NtCreateUserProcessOtherParentProcess

  • Checks BIOS information in registry

    BIOS information is often read in order to detect sandboxing environments.

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself

  • Executes dropped EXE

  • Drops file in System32 directory

  • Suspicious use of SetThreadContext

  behavioral1behavioral2behavioral3