Extracted

• • Target

    main1.bat

  • Size

    15KB

  • MD5

    837e6e693eab2459822a681dd8829347

  • SHA1

    77417d665e66ae2f962f52b3d7c916f0772f0615

  • SHA256

    57970a3c842bcaf6860a9d271b2725b08fc07a50ca18ff852983d8e80905a0c7

  • SHA512

    54f3d0f4a69d785dd6012f5376d131f3d4cdfa1885577c46468bf1e37aed1d7da86cc11b7efcddf53eede8a4803a16e14c008493404906e3b870ccd441278a48

  • SSDEEP

    384:wK1+KSlKC8kumFq/vM2pHz6YBM3P6QDSJO4ytvJ2/N2cGTuEhckk7VgFHbWvaPn0:wK1+KSlKC8++vM23b+CJXPn

  Score

  10^/10

  executionquasarbotspywaretrojan

  • Quasar RAT

    Quasar is an open source Remote Access Tool.

    trojanspywarequasar

  • Quasar family

    quasar

  • Quasar payload

  • Blocklisted process makes network request

  • Command and Scripting Interpreter: PowerShell

    Powershell Invoke Web Request.

    execution

  • Downloads MZ/PE file

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Legitimate hosting services abused for malware hosting/C2

  • Drops file in System32 directory

  behavioral1behavioral2