Extracted

• • Target
    startup_196.bat
  • Size 4.2MB
  • SHA256 38cccab10ce21045978e13c751a14e5fb1ad232e81415428b1a8db4408a737ea
  • MD5 21e452acb419fcf4fb59c1d9ca0159f0
  • SHA1 2335b8887120c51331f7d8947305d70ee1fb2157
  • SHA512 cac904de47360b8a58ee30195acab358f75a0f08881d022fce69501c10862f624cf96fde0341e71c214cbb7ff5e358e1a5b9908b720329b1595325bda97ca7fd
  • SSDEEP 49152:KeyCel7yc5izojnp9dFZBEv2IBJD2dmzdSYvB535HZd00xTCpe:V
  • TLSH
    T1941623268EAD9D9F4A74129C185D0E0F27A08E405453C9DBB3D27CBFAB8FE05162B17D
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  executionquasarspywaretrojan

  • Quasar RAT

    Quasar is an open source Remote Access Tool.

    trojanspywarequasar

  • Quasar family

    quasar

  • Quasar payload

  • Badlisted process makes network request

    Network request originating from process or tool commonly abused by malware.

  • Command and Scripting Interpreter: PowerShell

    Run Powershell and hide display window.

    execution

  • Contacts third-party web service commonly abused for C2

    Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

  behavioral1behavioral2