quasar | bed39fc7897d400ca51a382f7629f687eb75ea9d7cd0bfefd1e5be4c23145c05 | Triage™

Login
Reports

Overview

overview

Static

static

1

Loli.bat

windows10-2004-x64

Loli.bat

windows11-21h2-x64

Sharing

Copy URL Twitter E-mail

General

Target
Loli.bat
Size 11.5MB
Sample260223-thm1wsax6e
SHA256 bed39fc7897d400ca51a382f7629f687eb75ea9d7cd0bfefd1e5be4c23145c05
MD5 968c3f7cd908b76832e71f59eeff94e2
SHA1 a1868c1150260c5ed0a1931e29cd1857a67bc190
SHA512 8f630f936e7cd6a03bdf27dff842ae7c8f40d551fdecc0da0ef26accd1c8f10b28a27b3a40c7b9a4e65cb68a3509a7f6fed7ebf0eb32230bbc6b38e99a8a5497
SSDEEP 49152:dSna3saOVf2XSxH2Me4zBqbEFIU3n8Pzok7vK8nMu4+BNQ5uUiyVsHfwplVk8cbe:4
TLSH
T143C623771E363899784A78B942BD7C2B9F2104300B5FEDA2C1F2279A2D5FD190F4395A
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

quasar onichan~defense_evasion discovery evasion execution spyware trojan

Static task

static1

Behavioral task

behavioral1

Sample

Loli.bat

Resource

win10v2004-20260130-en

windows10-2004-x64

14 signatures

150 seconds

onichan~defense_evasion discovery evasion execution quasar spyware trojan

Behavioral task

behavioral2

Sample

Loli.bat

Resource

win11-20260130-en

windows11-21h2-x64

14 signatures

150 seconds

onichan~defense_evasion discovery evasion execution quasar spyware trojan

Malware Config

Extracted

Family

quasar

Version

1.5.2

Botnet

OniCHAN~

C2

aimbotfr-43342.portmap.host:43342

Mutex

a2d36a28-ece8-420c-a406-5106c3e257a2

Attributes

encryption_key
2568EDBF429D4745FE7EC67848063D60B82823D8
install_name
Client.exe
key_salt
bfeb1e56fbcd973bb219022430a57843003d5644d21e62b9d4f180e7e6c33941
log_directory
Logs
reconnect_delay
5000
startup_key
Quasar Modded Client Startup
subdirectory
SubDir

Targets

- Target
  Loli.bat
- Size 11.5MB
- SHA256 bed39fc7897d400ca51a382f7629f687eb75ea9d7cd0bfefd1e5be4c23145c05
- MD5 968c3f7cd908b76832e71f59eeff94e2
- SHA1 a1868c1150260c5ed0a1931e29cd1857a67bc190
- SHA512 8f630f936e7cd6a03bdf27dff842ae7c8f40d551fdecc0da0ef26accd1c8f10b28a27b3a40c7b9a4e65cb68a3509a7f6fed7ebf0eb32230bbc6b38e99a8a5497
- SSDEEP 49152:dSna3saOVf2XSxH2Me4zBqbEFIU3n8Pzok7vK8nMu4+BNQ5uUiyVsHfwplVk8cbe:4
- TLSH
  T143C623771E363899784A78B942BD7C2B9F2104300B5FEDA2C1F2279A2D5FD190F4395A
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

onichan~defense_evasion discovery evasion execution quasar spyware trojan
- Modifies Windows Defender DisableAntiSpyware settings
  evasion trojan
- Modifies Windows Defender Real-time Protection settings
  defense_evasion trojan
- Quasar RAT
  Quasar is an open source Remote Access Tool.
  trojan spyware quasar
- Quasar family
  quasar
- Quasar payload
- Command and Scripting Interpreter: PowerShell
  Using powershell.exe command.
  execution
behavioral1 behavioral2

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

PowerShell

Persistence

Create or Modify System Process

Windows Service

Privilege Escalation

Create or Modify System Process

Windows Service

Defense Evasion

Hide Artifacts

Ignore Process Interrupts

Impair Defenses

Disable or Modify Tools

Modify Registry

Credential Access

Discovery

Query Registry

Remote System Discovery

System Information Discovery

System Network Configuration Discovery

Internet Connection Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

onichan~defense_evasiondiscoveryevasionexecutionquasarspywaretrojan

behavioral2

onichan~defense_evasiondiscoveryevasionexecutionquasarspywaretrojan

© 2018-2026

Terms | Privacy