Extracted

• • Target

    noloud.bat

  • Size

    12KB

  • MD5

    e435591eabd5596e754a7acaede7dca7

  • SHA1

    2b1b728aae5d3e72fe4bc864559d0347489f995a

  • SHA256

    a599fcae8f2c31fb4bf0fe02b30e4ee4bd23d599c6c3d9a571df508a470d690d

  • SHA512

    3248a7cf8542068c126906b9db5e3fb0dde7ca123b7cf3f5375aad6b5c65bb909db5e3b5e127104e664b57eea4774d5283228533f01beb45b50ccdd3545e8f69

  • SSDEEP

    384:gTYcpQyuPmhDGEhtKCR2XYmE2JdAp6EbW263JM3jXMIccK:gTYcpQyuPmhDGEhtKCReU2JdjES3JQj4

  Score

  10^/10

  evasionexecutionpersistencetrojanquasarundercontroldiscoveryspyware

  • Quasar RAT

    Quasar is an open source Remote Access Tool.

    trojanspywarequasar

  • Quasar family

    quasar

  • Quasar payload

  • UAC bypass

    evasiontrojan

  • Blocklisted process makes network request

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Command and Scripting Interpreter: PowerShell

    Powershell Invoke Web Request.

    execution

  • Downloads MZ/PE file

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Adds Run key to start application

    persistence
  behavioral1behavioral2