Extracted

• • Target

    Uni.bat

  • Size

    10.4MB

  • MD5

    2cc589a27044382be0ec55f23f36fa41

  • SHA1

    4edc18c1b0e3558086e86d4e5c344fc9bed8d97c

  • SHA256

    d05dd87b7ce909f8f3f85607f9546bcbe1168a507955c4d504d8c83f02d9a909

  • SHA512

    baf948e4257cda2a0c30e9663448e884d40d844cc0f15cb64a9a2ccc40c12d1bdf1b5808d80b19c0f401478504468669d44edcdf0153f88d1b3ceb3303656045

  • SSDEEP

    49152:C/JouIj6nHI8l5lK7g/JLyDX7YVDazqMdubv+JrncVzgH+60gF4SLF+pHGwhESAG:K

  Score

  10^/10

  quasarv15.4.5 | seroxendefense_evasiondiscoverypersistencespywaretrojan

  • Quasar RAT

    Quasar is an open source Remote Access Tool.

    trojanspywarequasar

  • Quasar family

    quasar

  • Quasar payload

  • Suspicious use of NtCreateUserProcessOtherParentProcess

  • Sets service image path in registry

    persistence

  • Checks BIOS information in registry

    BIOS information is often read in order to detect sandboxing environments.

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself

  • Executes dropped EXE

  • Loads dropped DLL

  • Hide Artifacts: Hidden Window

    Windows that would typically be displayed when an application carries out an operation can be hidden.

    defense_evasion

  • Drops file in System32 directory

  • Suspicious use of SetThreadContext

  behavioral1behavioral2