Extracted

• • Target

    9273_output.vbs

  • Size

    1.6MB

  • MD5

    89444730511dcc04894433ad215e9f02

  • SHA1

    8af2c8469f0381666bbdfbb12965c48290ef817b

  • SHA256

    7bfbcbf1a30ba537264e189e39b2ada434fc451c99a7fe680aa6196cd931b625

  • SHA512

    121bcab2c0e4c0c307565742f03d4ebef33ba677f4591a2d95238c500c82fbeafd4d52521bdf57e0775178b081a95b877b561721ec72540b0beb4acf3548a19f

  • SSDEEP

    24576:prCPrx+7wnggpUvK3oVj1S1LYuhN0E7olLXm5ttA7AhazaJUelDBY1Qq0+BbUklh:g/rUTV40u3oli5LEgaaUKat0+BbeYz

  Score

  10^/10

  executionquasarsearchindexerspywaretrojan

  • Quasar RAT

    Quasar is an open source Remote Access Tool.

    trojanspywarequasar

  • Quasar family

    quasar

  • Quasar payload

  • Blocklisted process makes network request

  • Command and Scripting Interpreter: PowerShell

    Run Powershell and hide display window.

    execution

  • Command and Scripting Interpreter: PowerShell

    Using powershell.exe command.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Drops file in System32 directory

  behavioral1behavioral2behavioral3behavioral4