Extracted

• • Target
    https://cdn.discordapp.com/attachments/1150975805460070491/1156438135530602567/ogfncheats.bat?ex=66a9b4f1&is=66a86371&hm=f89c765d6f2038e3c7e72ebe113563fb3be60d553dfac6c67a45709ed1882cf5&

  Score

  10^/10

  quasarv2.2.3 | seroxendefense_evasiondiscoveryspywaretrojan

  • Quasar RAT

    Quasar is an open source Remote Access Tool.

    trojanspywarequasar

  • Quasar payload

  • Suspicious use of NtCreateUserProcessOtherParentProcess

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Indicator Removal: Clear Windows Event Logs

    Clear Windows Event Logs to hide the activity of an intrusion.

    defense_evasion

  • Hide Artifacts: Hidden Window

    Windows that would typically be displayed when an application carries out an operation can be hidden.

    defense_evasion

  • Suspicious use of SetThreadContext

  behavioral1