Extracted

• • Target

    RedwareSpoofer.bat

  • Size

    504KB

  • MD5

    7e3035eb197a52820c5a33c064917a8e

  • SHA1

    147d70a538be4135dbd2ad4dbf2fd750a6d387ee

  • SHA256

    747b16e1c41f4e99be3b52a4dbd712cd4d5407f6afffdf5d20f61b2e4c4d63b6

  • SHA512

    f95b2c680d39bd529dac582aed23340b196bf85bb0bb2011261c8c3d59962d71e18e0d675bfd73c1e24675cc499e022cdc62b9daadd6b0f877ec97988ca8737c

  • SSDEEP

    12288:iuXbEUU3h+QHSyN1iWFTM1hK0gddk5uMmYmi0125gDv:iuXbjUR+IRiWFTMjKpkL7a2sv

  Score

  10^/10

  executionquasaroffice04defense_evasionpersistencespywaretrojan

  • Quasar RAT

    Quasar is an open source Remote Access Tool.

    trojanspywarequasar

  • Quasar family

    quasar

  • Quasar payload

  • Blocklisted process makes network request

  • Command and Scripting Interpreter: PowerShell

    Run Powershell and hide display window.

    execution

  • Sets file to hidden

    Modifies file attributes to stop it showing in Explorer etc.

    defense_evasion

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Adds Run key to start application

    persistence

  • Drops file in System32 directory

  behavioral1behavioral2