Extracted

• • Target

    a63181dff0f68b98712247f51c8a6e7761f8a84261928c297b12f438272c1492.vbs

  • Size

    1.6MB

  • MD5

    7e0b7c6c89827a608664bf468d850933

  • SHA1

    adcfcf643b371e24d79353f4f88231170229949f

  • SHA256

    a63181dff0f68b98712247f51c8a6e7761f8a84261928c297b12f438272c1492

  • SHA512

    ddfbaaaf6e7f06f5cbaa35e3b188064e71a6b4542185ecf71e0a89ed6411d98059c0b37b8ad3288b4029d5ddf870a3ad9f342fb521331ee1f39a2dad741778bd

  • SSDEEP

    24576:PLOiXTUVNhZXj4TARZ3zRdIwEtiQXNosn/eYwv2FpZHFLKOJFErpvGcZqF:bINzTLgrSK/fJ7HpeYcy

  Score

  10^/10

  discoveryexecutionpersistencequasar2025spywaretrojan

  • Quasar RAT

    Quasar is an open source Remote Access Tool.

    trojanspywarequasar

  • Quasar family

    quasar

  • Quasar payload

  • Blocklisted process makes network request

  • Command and Scripting Interpreter: PowerShell

    Run Powershell and hide display window.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Adds Run key to start application

    persistence

  • Drops file in System32 directory

  behavioral1behavioral2