Extracted

Extracted

Extracted

• • Target

    n.cmd

  • Size

    1KB

  • MD5

    fa75e849a3beb187d543d9b4ae894dcc

  • SHA1

    41b1a755057677bfa617c089ba6092733155a1f0

  • SHA256

    ea4b2c7dbf2be84aa81e55112e40392a7c54cfabde85d3ece594d834b3c9254d

  • SHA512

    eed68bf4aba6af83620591f9cdefbe5e954f5bfbb14116015c215b306ecde7e8f9736b7e886e6ecbc0a71dda8ba2a58c7f4b5b7b6354104652715052e016f91f

  Score

  10^/10

  executionquasarafafafspywaretrojan

  • Quasar RAT

    Quasar is an open source Remote Access Tool.

    trojanspywarequasar

  • Quasar family

    quasar

  • Quasar payload

  • Blocklisted process makes network request

  • Command and Scripting Interpreter: PowerShell

    Using powershell.exe command.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  behavioral1behavioral2