Extracted

• • Target
    x.bat 2.exe
  • Size 10.1MB
  • SHA256 f357c6aa43a97fad3e6c4470db332dfcdcdd80956c335309741bc1d653477642
  • MD5 0233c955facfe936576e4122be1c23c9
  • SHA1 b62c4c9ccf0472320ecdb50f2d464b11b805cbb4
  • SHA512 93ac6c8030b07fe3dd47b0bf45fb87a2de31af9ce13f12c38c33f3c5606c4310cc2d61eb96d90bd063f37c22ee32d53a38be518c375a842215c3805dc377d108
  • SSDEEP 49152:evffm/FDQ8Ye9hDAvxXDLYAAlzftM1TSlwBbMQ4VT8pkqvtA5moGVWJoC1A23LKa:1
  • TLSH
    T1FAB62378D0CB36EF0901D2FBB625E505B0D933C74B4286564378C7A239E45B4EAB7CA6
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defense_evasionexecutionquasarmodulepersistenceprivilege_escalationratspywaretrojan

  • Family: Quasar RAT

    Quasar is an open source Remote Access Tool.

    trojanspywarequasar

  • PulsaRAT library module

    Core component of the PulsaRAT remote access trojan, implementing its command protocol for hidden remote desktop, UAC bypass, persistence, and credential theft.

    ratmodule

  • Quasar payload

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Event Triggered Execution: Component Object Model Hijacking

    Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.

    persistenceprivilege_escalation

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • Deobfuscate/Decode Files or Information

    Payload decoded via CertUtil.

    defense_evasion

  • Executes a VBScript file via the Windows Script Host.

    execution

  • Suspicious use of NtSetInformationThreadHideFromDebugger

    defense_evasion
  behavioral1behavioral2