Extracted

• • Target
    bfb.bat
  • Size 3.4MB
  • SHA256 173f5ce196c1b15c19c62bdcb0ce16e2647f7e495a436efebf682f55c20e3e4f
  • MD5 a2e81d0ee878c258dbe588c510080358
  • SHA1 d6afbd47d42c64cca0436fc8acbcdb7ef56f87a2
  • SHA512 a8d9272d095710f5e3ec27bf4f6552af93883a60fe6505c85af36f0ad2c8cd99f64c9b52c6ddf23a021f1be9f143fe88de821bfeb2fd5cc81cd465b0f5d43007
  • SSDEEP 49152:PKj+oIAOfFn62ecEDMTGhoLglGpM7qetLG+Af7VCRTDfJsq:S
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  executionquasardefense_evasiondiscoveryspywaretrojan

  • Quasar RAT

    Quasar is an open source Remote Access Tool.

    trojanspywarequasar

  • Quasar payload

  • Suspicious use of NtCreateUserProcessOtherParentProcess

  • Blocklisted process makes network request

  • Command and Scripting Interpreter: PowerShell

    Run Powershell and hide display window.

    execution

  • Checks BIOS information in registry

    BIOS information is often read in order to detect sandboxing environments.

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Indicator Removal: Clear Windows Event Logs

    Clear Windows Event Logs to hide the activity of an intrusion.

    defense_evasion

  • Drops file in System32 directory

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  • Suspicious use of SetThreadContext

  behavioral1behavioral2