Extracted

• • Target

    Uni.bat

  • Size

    586KB

  • MD5

    3a43120a8dd1e42ff894670710bd8bc4

  • SHA1

    dbb9244231da204517f5d7a0e5ca713b64a3c175

  • SHA256

    b3db27588a80527cb09b85476ed59ce698dc9a4b6b03246160de944ecc5ca79d

  • SHA512

    15931135fd1fec93a3d77e0f28a19ca0780e7de34ab6a4f8174999cf534b4f810ace2bba0db3f2d0d0007199771b16d0c2bc3cdee48ef00a19be4705d3c26026

  • SSDEEP

    12288:qAtzNGPPmXaudwDKHYeRfRJUnYNY+yjOc3zRMh0KYQgrR3dih:3BsXvudwG4eR5yN6c3VS0KZ9

  Score

  10^/10

  executionquasarseroxenspywaretrojan

  • Quasar RAT

    Quasar is an open source Remote Access Tool.

    trojanspywarequasar

  • Quasar payload

  • Blocklisted process makes network request

  • Command and Scripting Interpreter: PowerShell

    Run Powershell and hide display window.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Drops file in System32 directory

  behavioral1behavioral2