Extracted

• • Target

    Loli.bat

  • Size

    7.2MB

  • MD5

    d266b84f245e8de76e05e762e3b7cfca

  • SHA1

    ed75a3413e35ff95bb01a4027f38e2a0e22e2cae

  • SHA256

    26a49de957b5598e0c2e8d6d41d89320d3a363d9e6e4606237d2d487db6adaad

  • SHA512

    b19446cba7f08521accd3d8ab05312d454933e3e87c7b33b9f9c2d3f484e54f6ff4fb989649d6f467f7b2a44c7d7571d5e06348b7872f4ad8acceaad4ae95b4f

  • SSDEEP

    49152:2Ispe9WTFYTG/p+hBJhMIZHEUaS9Yvg/mAi+v16h18WqW18EfCfKNHppku4O3v9y:h

  Score

  10^/10

  executionpersistencequasarspywaretrojan

  • Quasar RAT

    Quasar is an open source Remote Access Tool.

    trojanspywarequasar

  • Quasar family

    quasar

  • Quasar payload

  • Suspicious use of NtCreateUserProcessOtherParentProcess

  • Blocklisted process makes network request

  • Command and Scripting Interpreter: PowerShell

    Run Powershell and hide display window.

    execution

  • Sets service image path in registry

    persistence

  • Checks BIOS information in registry

    BIOS information is often read in order to detect sandboxing environments.

  • Executes dropped EXE

  • Drops file in System32 directory

  • Suspicious use of SetThreadContext

  behavioral1behavioral2