Extracted

• • Target
    Xerox_LoaderV1.bat
  • Size 2KB
  • SHA256 94895ba18bfb5b19b99c797fdf38974c616f7d4f56c4d9fbdbc650295c3118eb
  • MD5 12f668608f19ae771d5608a25fa6e8d3
  • SHA1 a49525ac677758572c8ad40c6978cb75fdd46c49
  • SHA512 46f8f29ab7b260f8ad1c2973ef6459f1fc1132c660dc1d4da8eb98ae6a289fbb060c68f744e5ee1aee1af170c17f84e51bf5de3ea5220c1998dc69fed2a3ef33
  • TLSH
    T19E4167573160601C04FE42D9CEC0A64677ADC1EB43019BDC314AD5699F4D2E791EDBE4
  • MD5 SHA1 SHA512 TLSH

  Score

  10^/10

  defense_evasionexecutionquasarpersistencespywaretrojan

  • Family: Quasar RAT

    Quasar is an open source Remote Access Tool.

    trojanspywarequasar

  • Quasar payload

  • Looks for VirtualBox Guest Additions in registry

    defense_evasion

  • Badlisted process makes network request

    Network request originating from process or tool commonly abused by malware.

  • Command and Scripting Interpreter: PowerShell

    Run Powershell and hide display window.

    execution

  • Looks for VMWare Tools registry key

    defense_evasion

  • Executes dropped EXE

  • Contacts third-party web service commonly abused for C2

    Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

  • Deobfuscate/Decode Files or Information

    Payload decoded via CertUtil.

    defense_evasion

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  behavioral1behavioral2