Extracted

Extracted

Extracted

• • Target
    Xerox Loader.bat
  • Size 1KB
  • SHA256 d9926f9ce537dac77ef0603b3e65528dd20ec9932d0776d41ee95455e5004721
  • MD5 6921ef07205cbcc75cc19be0ecae0d53
  • SHA1 b697ebc3e18e87cea9e4e68eb7a407dad3669641
  • SHA512 2a7be4c6eb993873d3171ace078a001181e0c13c32c53ed20638f8fab16efcae0a6443b281ac10b05ba055b30be3e0b706acd3a7cbe55dcc92629eea6bcbb2d1
  • TLSH
    T15521013376119159058A56F88E7DB2453A4C8183C60579D9379FD0399F9D2C32BFA1CC
  • MD5 SHA1 SHA512 TLSH

  Score

  10^/10

  executiondefense_evasionquasarpersistencespywaretrojan

  • Family: Quasar RAT

    Quasar is an open source Remote Access Tool.

    trojanspywarequasar

  • Quasar payload

  • Badlisted process makes network request

    Network request originating from process or tool commonly abused by malware.

  • Executes dropped EXE

  • Command and Scripting Interpreter: PowerShell

    Using powershell.exe command.

    execution

  • Contacts third-party web service commonly abused for C2

    Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

  • Deobfuscate/Decode Files or Information

    Payload decoded via CertUtil.

    defense_evasion
  behavioral1behavioral2