Extracted

• • Target

    FortniteCleaner and Spoofer.bat

  • Size

    11.7MB

  • MD5

    2633869ac4a9cb98b01488ac2cb20d72

  • SHA1

    167871fab0a19acaf7ad22144d8fdb5b09959a28

  • SHA256

    6a52f0cf77b3706de713eff3d7e038ff13d5ca7c8fc837f4eee0adac079cf522

  • SHA512

    f4d48d8e672d828c79b65b886c1ca3a423701cd6a8077c0ab78c4d2e60284ed505fc971975beab3e79bd9b9c20f821b52111258642c8bbb4024891a343004543

  • SSDEEP

    49152:z+8TuE0MoXJ8qRdxr47sbd6rBJYqfpbAgpK64KspQPEf+UWONvGFni6xha3DrNG0:k

  Score

  10^/10

  executionquasarv3.0.6 | zunidefense_evasionspywaretrojan

  • Quasar RAT

    Quasar is an open source Remote Access Tool.

    trojanspywarequasar

  • Quasar family

    quasar

  • Quasar payload

  • Command and Scripting Interpreter: PowerShell

    Run Powershell and hide display window.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself

  • Executes dropped EXE

  • Impair Defenses: Safe Mode Boot

    defense_evasion

  • Hide Artifacts: Hidden Window

    Windows that would typically be displayed when an application carries out an operation can be hidden.

    defense_evasion

  • Drops file in System32 directory

  behavioral1behavioral2