quasar | 74d855b746631d1e09001d6dc864533dfe38094f4f0d98e0ce3cbdfb324ce601

Analysis

max time kernel
149s
max time network
150s
platform
windows11-21h2_x64
resource
win11-20260130-en
resource tags

arch:x64arch:x86image:win11-20260130-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
28/03/2026, 11:00

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
sar64.exe
Size 3.1MB
Sample260328-m4b27abz2l
SHA256 74d855b746631d1e09001d6dc864533dfe38094f4f0d98e0ce3cbdfb324ce601
MD5 4e50edcef0fc8d58333e9336578b2e0b
SHA1 3d5b29257c94e1aa81dd2ae8819c62a58e028c55
SHA512 0f3cb15b827ed6d7f68bc43b06e90d5ee3e4270a30e079d6232fd709098c77f51ee12684eac471a695e2ce711061b02e3cd21c6044a8a1202f5d5447cb0e9168
SSDEEP 49152:Xvze821/aQWl8P0lSk3aKA3Z+nxlxNESE/k/iuLoGdCRTHHB72eh2NT:XvS821/aQWl8P0lSk3DA3Z+nPxeQ
TLSH
T1ACE55B143BF85E23E1BBE273D5B0041667F0EC2AB3A3EB1B1191677E1C53B5059426AB
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

lqn.uk.com execution quasar persistence spyware trojan

Malware Config

Extracted

Family

quasar

Version

1.4.1

Botnet

lqn.uk.com

lqn.uk.com:80
lqn.uk.com:8080
lqn.uk.com:443
lqn.uk.com:8443
lqn.uk.com:3306

Mutex

dc84e7d7-1880-44d7-b9b1-977a69077998

Attributes

encryption_key
576D1496F563366ADEBFC3046D6584BB4AD91241
install_name
Client.exe
key_salt
bfeb1e56fbcd973bb219022430a57843003d5644d21e62b9d4f180e7e6c33941
log_directory
Logs
reconnect_delay
10
startup_key
https://lqn.uk.com
subdirectory
SubDir

Signatures

Quasar RAT
Quasar is an open source Remote Access Tool.
trojan spyware quasar
Quasar family
quasar

Quasar payload 1 IoCs

resource	yara_rule
behavioral2/memory/1040-0-0x0000000000650000-0x0000000000974000-memory.dmp	family_quasar

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3119821332-640943685-2562343641-1000\Software\Microsoft\Windows\CurrentVersion\Run\https://lqn.uk.com = "\"C:\\Users\\Admin\\AppData\\Roaming\\SubDir\\Client.exe\""	sar64.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
1180	schtasks.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	1040	sar64.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1040	sar64.exe

Suspicious use of SendNotifyMessage 1 IoCs

pid	Process
1040	sar64.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 1040 wrote to memory of 1180	1040	sar64.exe	79

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\sar64.exe
"C:\Users\Admin\AppData\Local\Temp\sar64.exe"
1⤵
- Adds Run key to start application
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1040
- C:\Windows\SYSTEM32\schtasks.exe
  "schtasks" /create /tn "https://lqn.uk.com" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\Client.exe" /rl HIGHEST /f
  2⤵
  - Scheduled Task/Job: Scheduled Task
  PID:1180