Extracted

• • Target

    0dcdaedf2f76dbc431635dbc53c893692cb644f5dbdfde46bc942b9806b8f0d7.vbs

  • Size

    274KB

  • MD5

    1c83c6f80fcddabd1336cc30aa68d08f

  • SHA1

    bb9c75690963d7c2bb608d5fb3b9b627b1bc4e34

  • SHA256

    0dcdaedf2f76dbc431635dbc53c893692cb644f5dbdfde46bc942b9806b8f0d7

  • SHA512

    832d55005c9192456337f840d409d79c6786fd8d2c97bb33ed04193903564ae3b4d31da0842cc522add532e4fb5b86a231890be90a4e0471b28276f57345d44a

  • SSDEEP

    6144:eUQydS/Z5QL2AEhyNqfrASLddf9USsPgd5QxwNsCQOod2zf:UyduQLnEh4qjASj9USsIP0wNPQ2zf

  Score

  10^/10

  discoveryexecutionquasarpersistencespywaretrojan

  • Quasar RAT

    Quasar is an open source Remote Access Tool.

    trojanspywarequasar

  • Quasar family

    quasar

  • Quasar payload

  • Blocklisted process makes network request

  • Command and Scripting Interpreter: PowerShell

    Run Powershell and hide display window.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Adds Run key to start application

    persistence

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Drops file in System32 directory

  behavioral1behavioral2