Extracted

• • Target
    output.bat
  • Size 552KB
  • SHA256 52673ce0852b419c3cef66af46cef46e9beae85db86fa29c6ca54293f2677f56
  • MD5 877ec872071100e04a4154315aa10aa4
  • SHA1 55848021964e52ef1cb1c0e3040d34880ef7a8e9
  • SHA512 0af90cd0efa5efbe3040b769dbb4dbedde7319ca974febe5e58bebffca83a3839a0540f7489813083b47c9a090a89ece296b431c41b5f4160d8fdba5a5019a41
  • SSDEEP 12288:XtAQor6pJq1tV9PojubUkvhz58HYOyTnoZpFRAY0:dAQor6pJqR9hpF58Hh2WRy
  • TLSH
    T124C423005DFB073E46A0876935638A8F27E94DEEC1A8B8A577FA04876F4F74A45DF408
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  costuraexecutionquasarpackerpersistencespywaretrojanadware

  • Family: Quasar RAT

    Quasar is an open source Remote Access Tool.

    trojanspywarequasar

  • Quasar payload

  • Badlisted process makes network request

    Network request originating from process or tool commonly abused by malware.

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Command and Scripting Interpreter: PowerShell

    Run Powershell and hide display window.

    execution

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  behavioral1behavioral2