Extracted

• • Target
    DupeInjectorV4.5.bat
  • Size 12.5MB
  • SHA256 c0fb1a0aa966a7dc839dba656af70a418ec83e5a4bf198847e98463b6a83d466
  • MD5 9ebe2b397ecf1a01e07e44afd46a5dc0
  • SHA1 63d042793e172b8eba86f6441da5d4ae062f1c9d
  • SHA512 fc1511b64e479552c0da59b077c6d7e7aab2b26b1b98dec6d61ed7c347c97755529c4baab0c8c0664469e52022ef8f9f7c3176bab77008b52c3fc8a34b8a348e
  • SSDEEP 49152:FcxMpA/HtGvmcs2tNbBOd5rHqPzIIT5M1S8svpEknvhasVRt2EDTttF+uzqT4Cx7:E
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  quasarv2.2.3 | seroxendefense_evasiondiscoveryspywaretrojan

  • Quasar RAT

    Quasar is an open source Remote Access Tool.

    trojanspywarequasar

  • Quasar payload

  • Suspicious use of NtCreateProcessExOtherParentProcess

  • Suspicious use of NtCreateUserProcessOtherParentProcess

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself

  • Executes dropped EXE

  • Indicator Removal: Clear Windows Event Logs

    Clear Windows Event Logs to hide the activity of an intrusion.

    defense_evasion

  • Loads dropped DLL

  • Hide Artifacts: Hidden Window

    Windows that would typically be displayed when an application carries out an operation can be hidden.

    defense_evasion

  • Suspicious use of SetThreadContext

  behavioral1behavioral2