Extracted

• • Target

    CritScriptInstaller.bat

  • Size

    6KB

  • MD5

    a3ea9257f9f074a20df56d8978be9e77

  • SHA1

    68d029092c7a591aac215e25269329c3c3859436

  • SHA256

    32d2658a968790aa0039cf23fd097da860b938fb07d8d0b2f6779a71f40817b1

  • SHA512

    a61143e0680eb03fbf625da8a58aa338e88f0e12c65a3c07b2c10eead02e7a753d64e3d4271c34b04941ef772d3e772f28b53355b1a46ce4fc6aafff164c3b46

  • SSDEEP

    192:k+6tCGPbseHYtPpUaYIKopCA8KyiXn2rCxHF:kviPpUaYIKor2i

  Score

  10^/10

  executionquasarddnsdiscoveryspywaretrojan

  • Quasar RAT

    Quasar is an open source Remote Access Tool.

    trojanspywarequasar

  • Quasar family

    quasar

  • Quasar payload

  • Blocklisted process makes network request

  • Command and Scripting Interpreter: PowerShell

    Powershell Invoke Web Request.

    execution

  • Downloads MZ/PE file

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself

  • Executes dropped EXE

  • Legitimate hosting services abused for malware hosting/C2

  behavioral1behavioral2