Extracted

• • Target
    syn.bat
  • Size 9.3MB
  • SHA256 2c202d0e153b53f5ac2ee8c1da23e0d5b3c8ed8ebf26e6683ccd88ee40216ba5
  • MD5 991bf85e6a38373f5bdf5aa3146f2dbe
  • SHA1 fe350599f2749c1fab63a396005009a56cda6069
  • SHA512 ee6baecbbb2416183035becf77145388a8512d995f2f7f17069c46a351ea93ce3c0fcb3520a71e01db92d89f33920c9d3e1bc9e5503ceac3e348ed278d2a2505
  • SSDEEP 49152:SIaiRzWKoneaYlooooooxMyOky3SDaYTZtJfBcfO0t1N7cdNg4YBWh4YhOt/kqqG:8
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  adwareoffice04defense_evasiondiscoveryexecutiondonutloaderquasarloaderpersistenceransomwarespywaretrojan

  • Detects DonutLoader

    loader

  • DonutLoader

    DonutLoader is a position-independent code that enables in-memory execution of VBScript, JScript, EXE, DLL files and dotNET assemblies.

    loaderdonutloader

  • Donutloader family

    donutloader

  • Quasar RAT

    Quasar is an open source Remote Access Tool.

    trojanspywarequasar

  • Quasar family

    quasar

  • Quasar payload

  • Badlisted process makes network request

    Network request originating from process or tool commonly abused by malware.

  • Command and Scripting Interpreter: PowerShell

    Run Powershell and hide display window.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Indicator Removal: Clear Windows Event Logs

    Clear Windows Event Logs to hide the activity of an intrusion.

    defense_evasion

  • Drops file in System32 directory

  behavioral1