Extracted

• • Target
    https://cdn.discordapp.com/attachments/1230400146219470872/1230865353471557723/SlottedAimV2.rar?ex=66c7def0&is=66c68d70&hm=eb52d062f52bcb0b3966ef6792f40968bc21b465beba6302a94e1e67b53fe5ff&

  Score

  10^/10

  quasarfortnitediscoveryevasionexecutionspywaretrojanupx

  • Deletes Windows Defender Definitions

    Uses mpcmdrun utility to delete all AV definitions.

    evasion

  • Quasar RAT

    Quasar is an open source Remote Access Tool.

    trojanspywarequasar

  • Quasar payload

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Executes dropped EXE

  • Loads dropped DLL

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Enumerates processes with tasklist

    discovery
  behavioral1