Extracted

• • Target

    69e99e962f784f1d4ac17447a74741ff7da3efe70522df9a7bc070b431e4bec0.bat

  • Size

    3.5MB

  • MD5

    baea34214aa1a2aa90de5d0b3d841882

  • SHA1

    5206d25733b9fcf0c4b52fb3002b8f5def87699d

  • SHA256

    69e99e962f784f1d4ac17447a74741ff7da3efe70522df9a7bc070b431e4bec0

  • SHA512

    7e906e15de93a06eb763d069ea07ca763e4e0fe0d8cb3a804aded05ac5063d65ef09fa2d130abce268d1c3fcee96b28701f6d1b9a612bd1b1dbcd0f0b53a5d3d

  • SSDEEP

    49152:a066fNaUEnvOthWSIdX+H3bjAq+hbPVjS:n

  Score

  10^/10

  executionquasardiscoveryspywaretrojan

  • Quasar RAT

    Quasar is an open source Remote Access Tool.

    trojanspywarequasar

  • Quasar family

    quasar

  • Quasar payload

  • Suspicious use of NtCreateUserProcessOtherParentProcess

  • Blocklisted process makes network request

  • Command and Scripting Interpreter: PowerShell

    Run Powershell and hide display window.

    execution

  • Checks BIOS information in registry

    BIOS information is often read in order to detect sandboxing environments.

  • Drops file in System32 directory

  • Suspicious use of SetThreadContext

  behavioral1behavioral2