Extracted

Extracted

• • Target

    $77-Built.bat

  • Size

    3.5MB

  • MD5

    297d7e65305917b5a212ca9f4b4d99d2

  • SHA1

    402192fd3b13ea1fd26403e227ceb119e8569b4c

  • SHA256

    cbe56ba5a86d713c4f57d42e3084f9879c379367c46054b805e85922e5654bf9

  • SHA512

    6055d50144ca5a3e6c8889a659d63d654a3a84fb2be78ad36335d0877095592b7923e309c9d818ea9d5fc17a7d4f1b61c3318acddb9ea5041cf0fd996e27cb1a

  • SSDEEP

    49152:cYbGAyBfhKnc19015vyfIchfKpcuGj8RmSMvANLFt/X9oS4ot3X3tLdDh:cG

  Score

  10^/10

  quasarrootkitexecutionspywaretrojan

  • Quasar RAT

    Quasar is an open source Remote Access Tool.

    trojanspywarequasar

  • Quasar payload

  • Suspicious use of NtCreateUserProcessOtherParentProcess

  • Command and Scripting Interpreter: PowerShell

    Run Powershell and hide display window.

    execution

  • Checks BIOS information in registry

    BIOS information is often read in order to detect sandboxing environments.

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Drops file in System32 directory

  • Suspicious use of SetThreadContext

  behavioral1behavioral2behavioral3