Extracted

• • Target

    ea0dbb78a37927ed07f0c30ad9e814c2f71a16e9a6e8356726f03637bb48a848.cmd

  • Size

    2.0MB

  • MD5

    a83ac24f3b7291351f52ea99c33b43ca

  • SHA1

    4819de0035af164608341bdab34fe277cc517536

  • SHA256

    ea0dbb78a37927ed07f0c30ad9e814c2f71a16e9a6e8356726f03637bb48a848

  • SHA512

    af2301759d1037f609b876090eb188f0747ecf7c4d3e5ebd23395389dd23c1398cd123a902d015d47018f1ef686b44908cca3280d86ccc4a1993b7c0388b9551

  • SSDEEP

    24576:r7ftZVfP4Eg45n691f/qE71faFpIx6SXP1nOEunZ8/O2x01+dHepYAk0NkVG7/dp:rdLA9Fi7IxDRK294y7D/h2R

  Score

  10^/10

  executionquasaroffice04defense_evasionspywaretrojan

  • Quasar RAT

    Quasar is an open source Remote Access Tool.

    trojanspywarequasar

  • Quasar family

    quasar

  • Quasar payload

  • Blocklisted process makes network request

  • Command and Scripting Interpreter: PowerShell

    Run Powershell and hide display window.

    execution

  • Executes dropped EXE

  • Loads dropped DLL

  • Indicator Removal: File Deletion

    Adversaries may delete files left behind by the actions of their intrusion activity.

    defense_evasion
  behavioral1behavioral2