Extracted

• • Target
    nebula.bat
  • Size 3.2MB
  • SHA256 5ad495f6524b49d1fb37dcc05e3e0211ac77726d7b6229928cecb25cdf8c660c
  • MD5 e3a851a9120dd7f2b9d55773d9624670
  • SHA1 f6c13fa9598b305ef79062cb6bee72d60790aed2
  • SHA512 de62a0bb6a65d93fa8b337fc1536c9832afa31cdb7e7f784727c2a8335960de8f241ee4fcf299e2b03ded6ff885006e493ee72279fd4fc02ef2b8ef41389ff9a
  • SSDEEP 49152:2ZwpJE6xJGnWs756bRBRB6ihJswXR92aDsD8Bv8niSYG:W
  • TLSH
    T11EF533030F7DBD9F855DCF3C422B6A5DB7280644E02C81A652CB49A6857F79262BFC39
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  nebuladefense_evasiondownloaderexecutioncustomerloaderdefendnotquasarhacktoolloaderspywaretrojanpersistence

  • Detects Defendnot

  • Family: Customer Loader

    Customer Loader is a downloader written in C#.

    downloaderloadercustomerloader

  • Family: Defendnot

    Defendnot is a tool designed to disable Microsoft Defender.

    hacktooldefendnot

  • Family: Quasar RAT

    Quasar is an open source Remote Access Tool.

    trojanspywarequasar

  • Quasar payload

  • Badlisted process makes network request

    Network request originating from process or tool commonly abused by malware.

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Command and Scripting Interpreter: PowerShell

    Run Powershell and hide display window.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  behavioral1behavioral2