Extracted

Extracted

Extracted

• • Target

    t.cmd

  • Size

    1KB

  • MD5

    c3a80dbc5b98aac01cc124b59ec52d7e

  • SHA1

    eae4d2a89be841042839e8bfeca7480a2ba327e4

  • SHA256

    4d5a2a643cdab50f0105e110a8187cd812a7ebbc7d903b8a8029cd3508094f32

  • SHA512

    addf559ed04d9cbaccdc25d87940c0c0af41e183087c9c956bab438b7cf755a7481aa88d534792c265ace9491302ae81343de77d4c93101a232d44d47500d5a9

  Score

  10^/10

  executionquasarnewspywaretrojan

  • Quasar RAT

    Quasar is an open source Remote Access Tool.

    trojanspywarequasar

  • Quasar family

    quasar

  • Quasar payload

  • Blocklisted process makes network request

  • Command and Scripting Interpreter: PowerShell

    Using powershell.exe command.

    execution

  • Command and Scripting Interpreter: PowerShell

    Start PowerShell.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  behavioral1behavioral2