Quasar RAT Delivered Through Bat Files, (Wed, Jun 11th)

This report analyzes an obfuscated Windows batch/PowerShell second-stage loader used to deliver the Quasar remote access trojan (RAT). The infection uses a decoy Office document to lure victims, performs an anti-sandbox disk-name check, downloads a PNG containing an encrypted payload which is decrypted and injected into a process, and establishes persistence via a scheduled task; the report includes indicators such as a SHA256 hash, download URLs, and a C2 domain.